PowerDNS Security Advisory 2026-13: Crafted packet using compression
pointers can lead to denial of service
* CVE: CVE-2026-73206
* Date: 2026-10-21T00:00:00+01:00
* Discovery date: 2026-07-10T00:00:00+01:00
* Affects: PowerDNS Authoritative Server up to and including 4.9.17,
5.0.7 and 5.1.4
* Not affected: PowerDNS Authoritative Server 4.9.18, 5.0.8 and 5.1.5
* Severity: High
* Impact: Denial of Service
* Exploit: A crafted DNS packet can cause a denial of service
decompressing the DNS names in the packet
* Risk of system compromise: None
* Solution: Upgrade to patched version
* CWE: CWE-770
* CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* Last affected: 4.9.17,5.0.7,5.1.4
* First fixed: 4.9.18,5.0.8,5.1.5
* Internal ID: 537
* External Reporter: Yuheng Zhang et al.
A malicious server can send a crafted reply that leads to high resource
utilization decompression name pointers in DNS packets. This is a
multi-vendor issue. Multiple DNS vendors are releasing fixed version of
their products.
CVSS Score: 7.5
The remedy is: upgrade to a patched version. The patched version
imposes limits on the number of decompression done for a single name
and for a DNS packet as a whole.
We would like to thank Yuheng Zhang, Tsinghua University & Jingxian
Technology Co., Ltd.; Zihan Zhang, Shanghai Jiao Tong University &
Jingxian Technology Co., Ltd.; Jianjun Chen, Tsinghua University; Zihan
Wang, Z.AI Co., Ltd.; and Kaiwen Shen, CloudItera for reporting this
issue and coordinating release with other vendors.
