Hello, a follow-up to my mail about the /etc/hosts problem in pdns-recursor 4.8.8-1+deb12u1 (patch attached to that mail, upstream commit a867410a2183).
PowerDNS published Security Advisory 2026-12 on 21 October, seven CVEs in the Recursor, fixed in 5.3.12 and 5.4.8: https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-12.html The advisory names only 5.3.x and 5.4.x as affected and does not say anything about 4.x. The security tracker lists all seven as vulnerable for bookworm. I compared the fix commits of 5.4.8 with the source of rec-4.8.8. This is reading code, I did not build exploits: CVE-2026-73206 name decompression DoS probably affected, 4.8.8 has no limit per packet and none for pointer to pointer chains CVE-2026-73205 TIME_WAIT sockets affected, no IP_BIND_ADDRESS_NO_PORT in tcpconnect() CVE-2026-85555 out-of-band NS, DNSSEC probably affected, getAddrs() does not restore d_wasOutOfBand CVE-2026-85556 OPT RR owner name affected, hasEDNS() does not check the name CVE-2026-85558 closed TCP clients kept affected, same decrement pattern in rec-tcp.cc CVE-2026-85557 web server without TLS not affected, 4.8.8 has no TLS in the web server CVE-2026-85559 findScopeZero not affected, the function does not exist in 4.8.8 The tracker also lists a number of older open pdns-recursor issues for bookworm (33 entries in total at the moment, not all of them apply to 4.8.8). Because of this I would like to ask if a pdns-recursor update for bookworm is planned, and if so, whether the /etc/hosts patch from my first mail could go into the same upload. It is small (one file) and the upstream fix is in all releases since 4.9.0. If it helps, I can test a package on a VyOS system that uses export-etc-hosts, and I can check how the fixes of 5.4.8 apply to the 4.8.8 source. Thank you and best regards Ruben Herold
