CVE-2014-8601: PowerDNS Recursor delegation chaining denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote denial of service with a high EPSS percentile, though impact is limited to availability and a fixed version exists.

What it is

PowerDNS Recursor before 3.6.2 does not limit delegation chaining, so a remote attacker can force the resolver to follow a large or effectively infinite number of referrals. This degrades resolver performance and can deny service to legitimate clients relying on that recursor.

Impact

An unauthenticated remote attacker can cause performance degradation or denial of service on the affected recursor, disrupting DNS resolution for its users.

Attack surface

Reachable over the network via DNS queries that trigger excessive referral chains; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is high (0.68875, 99.3rd percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade PowerDNS Recursor to 3.6.2 or later, or apply the vendor advisory fix.
• Apply the Debian DSA-3096 update if running the packaged Debian version.
• Restrict recursive resolver exposure to trusted clients and block open recursion from the internet.
• Monitor and rate-limit outbound queries to untrusted or anomalous authoritative servers.
• Review resolver resource limits and timeouts to reduce impact of referral floods.

Detection

• Monitor recursor query rates and referral counts for abnormal spikes or long delegation chains.
• Alert on repeated resolution attempts for domains exhibiting deep or looping referral behavior.
• Track recursor CPU, memory and latency metrics for degradation correlated with specific query patterns.
• Review logs for queries to known abusive domains such as those cited in the advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.