Today we have released PowerDNS Recursor 5.3.12 and 5.4.8.
These releases provide fixes for PowerDNS Security Advisory
- 2026-12 for PowerDNS Recursor: Multiple issues
There are several CVEs associated with this advisory, three with severity High and the remaining with severity Medium or Low.
- CVE-2026-73206: A crafted DNS packet can cause a denial of service decompressing the DNS names in the packet
- CVE-2026-73205: A malicious client can cause too many TCP connections in TIME_WAIT state
- CVE-2026-85555: DNSSEC validation bypass and cache poisoning in PowerDNS Recursor via out-of-band NS resolution
- CVE-2026-85556: Missing OPT RR owner-name validation bypasses ECS hardening
- CVE-2026-85557: Single web client not doing TLS handshake monopolizes web access
- CVE-2026-85558: Recursor retains closed TCP client addresses until process exit
- CVE-2026-85559: Out-of-bounds read in Recursor findScopeZero
Please refer to the changelogs (5.3.12 and 5.4.8) and the full security advisory for additional details.
Please send us all feedback and issues you might have via the mailing list, or in case of a bug, via GitHub.
The tarballs (5.3.12, 5.4.8) (with signature files 5.3.12, 5.4.8) are available from our download server and packages for several distributions are available from our repository.
We made changes to our Open Source End of Life policy. Older release trains are now supported for one year after the following major release. Consult the EOL policy for more details.
We are grateful to the PowerDNS community for the reporting of bugs, issues, feature requests, and especially to the submitters of fixes and implementations of features.
