Denial of Service Vulnerability in PowerDNS Authoritative Server
CVE-2016-5426

7.5HIGH

Key Information:

Vendor

Powerdns

Status
Authoritative
Vendor
CVE Published:
21 September 2016

What is CVE-2016-5426?

PowerDNS Authoritative Server prior to version 3.4.10 is susceptible to a denial of service attack, whereby a malicious actor can exploit this vulnerability by sending crafted DNS queries with overly long qnames. This may lead to excessive CPU consumption on the backend, potentially disrupting service availability and impacting the performance of the DNS infrastructure. Users are advised to update their PowerDNS installations to the latest version to mitigate this risk and ensure robust security.

References

https://github.com/PowerDNS/pdns/commit/881b5b03a590198d0...
x_refsource_CONFIRM
http://www.securitytracker.com/id/1036761
vdb-entryx_refsource_SECTRACK
http://www.debian.org/security/2016/dsa-3664
vendor-advisoryx_refsource_DEBIAN

EPSS Score

33% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2016-5426 : Denial of Service Vulnerability in PowerDNS Authoritative Server