CVE-2025-59023

Published Feb 9, 2026

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59023 is a vulnerability found in PowerDNS Recursor software, specifically affecting versions 5.1.0, 5.2.0, and 5.3.0 (up to and including 5.1.7, 5.2.5, and 5.3.0). The core issue stems from insufficient verification of data authenticity when the Recursor processes DNS delegations and IP fragments. This flaw allows attackers to craft malicious DNS delegations or manipulate IP fragments to poison the cached delegations within the Recursor. Such cache poisoning can result in the Recursor providing incorrect DNS information, which could potentially redirect users or services to domains or IP addresses controlled by an attacker. The vulnerability can be exploited remotely without requiring authentication or user interaction. To mitigate this, users are advised to upgrade to patched versions such as PowerDNS Recursor 5.1.8, 5.2.6, or 5.3.1.

Description: Crafted delegations or IP fragments can poison cached delegations in Recursor.
Source: security@open-xchange.com
NVD status: Analyzed
Products: recursor

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.2
Impact score: 4.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-294

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E5A6FD19-7754-4B1E-A7CB-C4C0E22301CA",
            "versionEndExcluding": "5.1.8",
            "versionStartIncluding": "5.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1DD638CF-6817-4E4E-A171-50A3BFDF8E52",
            "versionEndExcluding": "5.2.6",
            "versionStartIncluding": "5.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A42E909F-1A37-4BBA-A17C-CC744C12D3C3",
            "versionEndExcluding": "5.3.1",
            "versionStartIncluding": "5.3.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.