← Vulnerability feed

Vulnerability record · CVE-2016-5427 · published 21 September 2016

CVE-2016-5427: PowerDNS Authoritative Server dot-in-label query causes CPU exhaustion

Powerdns · Authoritative

PowerDNS Authoritative Server before 3.4.10 mishandles a dot inside DNS labels, so a crafted query drives excessive backend CPU consumption. The flaw is remotely reachable without authentication and results in a denial of service against the name server.

7.5 CVSS 3.0 High EPSS 63% · top 0.8% CWE-399 · CWE-399
7.5CVSS 3.0 base score, v2 5.0
63%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of service (backend CPU consumption) via a crafted DNS query.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated availability impact with a high EPSS score and a known fixed version make timely patching important.

What it is

PowerDNS Authoritative Server before 3.4.10 mishandles a dot inside DNS labels, so a crafted query drives excessive backend CPU consumption. The flaw is remotely reachable without authentication and results in a denial of service against the name server.

Impact

An attacker can exhaust backend CPU on the authoritative server, degrading or halting DNS resolution for zones it serves. No data confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reached over the network by sending a crafted DNS query to the PowerDNS Authoritative Server; the CVSS vector shows no privileges and no user interaction required. Any host able to reach the DNS service can attempt it.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.63 (99th percentile), indicating elevated likelihood of exploitation activity. References include a vendor advisory and a fix commit, but no public exploit tag is present.

What to do

  • Upgrade PowerDNS Authoritative Server to 3.4.10 or later, or apply the vendor fix commit 881b5b03a590198d03008e4200dd00cc537712f3.
  • Apply the Debian DSA-3664 update if running the packaged version.
  • Restrict DNS service exposure to trusted resolvers and clients where operationally possible.
  • Rate-limit or filter malformed queries containing dots inside labels at the network edge.
  • Monitor backend CPU and query rates for anomalies during and after remediation.

Detection

  • Alert on DNS queries containing a dot inside a label, especially repeated or high-volume patterns.
  • Monitor PowerDNS backend CPU utilization and query latency for spikes consistent with crafted queries.
  • Review DNS server logs for malformed query bursts from single or distributed sources.
  • Track query rate per source and flag sources sending abnormal label structures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.debian.org/security/2016/dsa-3664
http://www.openwall.com/lists/oss-security/2016/09/09/3 Release Notes
http://www.securityfocus.com/bid/92917
http://www.securitytracker.com/id/1036761
https://doc.powerdns.com/md/security/powerdns-advisory-2016-01/ Vendor Advisory
https://github.com/PowerDNS/pdns/commit/881b5b03a590198d03008e4200dd00cc537712f3
http://www.debian.org/security/2016/dsa-3664
http://www.openwall.com/lists/oss-security/2016/09/09/3 Release Notes
http://www.securityfocus.com/bid/92917
http://www.securitytracker.com/id/1036761
https://doc.powerdns.com/md/security/powerdns-advisory-2016-01/ Vendor Advisory
https://github.com/PowerDNS/pdns/commit/881b5b03a590198d03008e4200dd00cc537712f3

Track CVE-2016-5427 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-33608Powerdns authoritative code injection vulnerabilityAn attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its confi…EPSS 0.59%9.8CVE-2020-24698Powerdns authoritative double free vulnerabilityAn issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker might…EPSS 3.2%8.6CVE-2026-42000Powerdns authoritative command injection vulnerabilityInsufficient Validation of Names During AXFREPSS 0.54%8.1CVE-2020-24696Powerdns authoritative race condition vulnerabilityAn issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote, unauthenticated attacker can t…EPSS 1.4%7.8CVE-2015-5470Powerdns authoritative vulnerabilityThe label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x…EPSS 11%7.8CVE-2015-1868PowerDNS label decompression self-referential name denial of serviceThe label decompression code in PowerDNS Recursor (3.5.x, 3.6.x before 3.6.3, 3.7.x before 3.7.2) and Authoritative Server (3.2.x, 3.3.x before 3.3.2…EPSS 82%analysed7.5CVE-2026-42001Powerdns authoritative uncontrolled resource consumption vulnerabilityInsufficient Validation of Autoprimary SOA QueriesEPSS 0.80%7.5CVE-2026-42002Powerdns authoritative vulnerabilityConcurrency and locking defects in GSS-TSIGEPSS 0.58%

Source: NIST National Vulnerability Database (record CVE-2016-5427), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.