Critical Vulnerability in pdns and pdns-recursor Packages
Summary
DEBIAN-CVE-2026-73206: ... Affects pdns versions 4.7.3-2 – 5.1.5-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pdns (PowerDNS) package is a versatile DNS server that provides authoritative and recursive DNS services. It is widely used for its performance and flexibility, supporting various backends and configurations. The pdns-recursor package serves as a DNS resolver, enabling efficient DNS queries. Both packages are integral to DNS infrastructure, making their security paramount. This vulnerability affects multiple versions across different Debian distributions, including Bookworm, Trixie, and Forky.
Vulnerability Detail
CVE-2026-73206 is a critical vulnerability affecting the pdns and pdns-recursor packages. The vulnerability originates from improper handling of DNS queries, which could allow an attacker to exploit the system, potentially leading to denial of service or unauthorized access. The technical details indicate that the flaw can be triggered by specially crafted DNS requests, making it essential for users to address this issue promptly to safeguard their systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the DNS server by configuring firewall rules to limit incoming requests to trusted IP addresses only. This can help mitigate the risk until the packages are updated. Example command to block all incoming traffic except from a specific IP:
sudo iptables -A INPUT -p tcp --dport 53 -s <trusted_ip> -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 53 -j DROP
Conclusion
The CVE-2026-73206 vulnerability poses a significant risk to users of the pdns and pdns-recursor packages. It is crucial to update these packages to the latest versions to mitigate potential threats. Users should also consider implementing temporary workarounds to enhance security until updates can be applied.
See every vulnerability recorded for pdns →
FAQ
CVE-2026-73206 is a critical vulnerability affecting the pdns and pdns-recursor packages, which could allow attackers to exploit the system through specially crafted DNS queries.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, restrict access to your DNS server using firewall rules to limit incoming requests to trusted IP addresses.
It is recommended to regularly check for vulnerabilities in your software dependencies, ideally on a weekly basis, to ensure your systems remain secure.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, helping developers maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for pdns.
