---
title: PowerDNS Security Advisory 2025-06
description: "PowerDNS Security Advisory 2025-06: Crafted delegations or IP fragments can poison cached delegations in Recursor"
---

[PowerDNS Blog ](https://blog.powerdns.com)

# [PowerDNS Security Advisory 2025-06](https://blog.powerdns.com/powerdns-security-advisory-2025-06-2025-10-22)

 Written by [Otto Moerbeek](https://blog.powerdns.com/author/otto-moerbeek) | Oct 22, 2025 12:09:49 PM

Today we have released PowerDNS Recursor 5.1.8, 5.2.6 and 5.3.1.

These releases fix PowerDNS Security Advisory 2025-06: Crafted delegations or IP fragments can poison cached delegations in Recursor:

#### PowerDNS Security Advisory 2025-06: Crafted delegations or IP fragments can poison cached delegations in Recursor

CVE: CVE-2025-59023   
Date: 15th October 2025  
Affects: PowerDNS Recursor up to and including 5.1.7, 5.2.5 and 5.3.0  
Not affected: PowerDNS Recursor 5.1.8, 5.2.6 and 5.3.1  
Severity: High  
Impact: Cache pollution  
Exploit: This problem can be triggered by an attacker spoofing crafted delegations  
Risk of system compromise: None  
Solution: Upgrade to patched version

CVSS Score: 8.2, see  
[https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L&version=3.1](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L&version=3.1)

CVE: CVE-2025-59024   
Date: 15th October 2025  
Affects: PowerDNS Recursor up to and including 5.1.7, 5.2.5 and 5.3.0  
Not affected: PowerDNS Recursor 5.1.8, 5.2.6 and 5.3.1  
Severity: Medium  
Impact: Cache pollution  
Exploit: This problem can be triggered by an attacker using an UDP IP fragments attack  
Risk of system compromise: None  
Solution: Upgrade to patched version

CVSS Score: 6.5 see  
[https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L&version=3.1](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L&version=3.1)

It has been brought to our attention that the Recursor does not apply strict enough validation of received delegation information. The malicious delegation information can be sent by an attacker spoofing packets.

The updated versions of the Recursor apply strict validation of the received delegation information from authoritative servers. In versions 5.2.6 and 5.3.1 the already existing validations are tightened further, while version 5.1.8 contains a full backport of the strict validations. Note that other vendors will release updated software to fix similar issues as well.

Please refer to the changelogs  ([5.1.8](https://doc.powerdns.com/recursor/changelog/5.1.html#change-5.1.8), [5.2.6](https://doc.powerdns.com/recursor/changelog/5.2.html#change-5.2.6) and [5.3.1](https://doc.powerdns.com/recursor/changelog/5.3.html#change-5.3.1)) for additional details

Please send us all feedback and issues you might have via the [mailing list](https://mailman.powerdns.com/mailman/listinfo/pdns-users), or in case of a bug, via [GitHub](https://github.com/PowerDNS/pdns/issues/new/choose).

The tarballs ([5.1.8](https://downloads.powerdns.com/releases/pdns-recursor-5.1.8.tar.bz2), [5.2.6](https://downloads.powerdns.com/releases/pdns-recursor-5.2.6.tar.bz2), [5.3.1](https://downloads.powerdns.com/releases/pdns-recursor-5.3.1.tar.xz)) (with signature files [5.1.8](https://downloads.powerdns.com/releases/pdns-recursor-5.1.8.tar.bz2.sig), [5.2.6](https://downloads.powerdns.com/releases/pdns-recursor-5.2.6.tar.bz2.sig), [5.3.1](https://downloads.powerdns.com/releases/pdns-recursor-5.3.1.tar.xz.sig)) are available from our download [server](https://downloads.powerdns.com/releases/) and packages for several distributions are available from our [repository](https://repo.powerdns.com/).

Recently we made changes to our Open Source End of Life policy. Older release trains are now supported for one year after the following major release. Consult the EOL [policy](https://docs.powerdns.com/recursor/appendices/EOL.html) for more details.

We are grateful to the PowerDNS community for the reporting of bugs, issues, feature requests, and especially to the submitters of fixes and implementations of features.

 

[View full post](https://blog.powerdns.com/powerdns-security-advisory-2025-06-2025-10-22)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Otto Moerbeek"
  },
  "dateModified" : "2025-12-08T12:30:13.050Z",
  "datePublished" : "2025-10-22T12:09:49Z",
  "headline" : "PowerDNS Security Advisory 2025-06",
  "image" : {
    "@type" : "ImageObject",
    "height" : 540,
    "url" : "https://20334960.fs1.hubspotusercontent-na1.net/hubfs/20334960/PowerDNS_recursor_release_blog.png",
    "width" : 1008
  },
  "mainEntityOfPage" : "https://blog.powerdns.com/powerdns-security-advisory-2025-06-2025-10-22",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "PowerDNS Blog"
  }
}
```