PowerDNS Security Advisory 2025-08: Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor

  • CVE: CVE-2025-59030

  • Date: 8th December 2025

  • Affects: PowerDNS Recursor up to and including 5.3.2, 5.2.6 and 5.1.8

  • Not affected: PowerDNS Recursor 5.3.3, 5.2.7 and 5.1.9

  • Severity: High

  • Impact: Denial of Service

  • Exploit: This problem can be triggered by a notify arriving over TCP and allows clearing caches

  • Risk of system compromise: None

  • Solution: Upgrade to patched version or prevent incoming notifies over TCP

CVSS Score: 7.5, see https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1

The remedy is: upgrade to patched version or prevent incoming notifies over TCP.