A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade pdns | Mar 22, 2019 | Mar 21, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 21, 2019 |
| Debian | — | Upgrade pdns | Apr 1, 2019 | Mar 21, 2019 |
| Freebsd | — | Upgrade powerdns | Mar 20, 2019 | Mar 19, 2019 |
| Suse | — | Upgrade pdns-backend-luaUpgrade pdns-backend-godbcUpgrade pdns-backend-sqlite3Upgrade pdns-backend-geoipUpgrade pdns-backend-mydnsUpgrade pdns-backend-remoteUpgrade pdnsUpgrade pdns-backend-postgresqlUpgrade pdns-backend-mysqlUpgrade pdns-backend-ldap | Apr 3, 2019 | Mar 18, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub