Описание
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| pdns-recursor | fixed | 5.4.3-1 | package | |
| pdns-recursor | end-of-life | bookworm | package | |
| pdns-recursor | end-of-life | bullseye | package | |
| pdns | fixed | 5.1.2-1 | package | |
| pdns | end-of-life | bookworm | package | |
| pdns | end-of-life | bullseye | package | |
| dnsdist | fixed | 2.1.0-1 | package | |
| dnsdist | end-of-life | bookworm | package | |
| dnsdist | end-of-life | bullseye | package |
Примечания
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-08.html#cve-2026-42005-unbounded-resource-consumption-in-internal-webserver
Only affects pdns-rec 5.2.x, marking first 5.3 upload as fixed version
https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-07.html
https://github.com/PowerDNS/pdns/commit/11e4f2da8259e5070e7a193f48d23ade38b71dc0
https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html#cve-2026-42005-insufficient-input-validation-of-internal-web-server
Связанные уязвимости
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
