CVE-2017-15120: PowerDNS Recursor NULL pointer dereference in authoritative answer parsing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote unauthenticated crash of a core DNS service with a high EPSS score, though impact is limited to availability and no KEV or public exploit is recorded.

What it is

PowerDNS Recursor before 4.0.8 dereferences a NULL pointer while parsing an authoritative answer that contains a CNAME record of a class other than IN. A remote, unauthenticated party can crash the recursor, taking DNS resolution down for everything that depends on it. The flaw is a straightforward parsing defect in the answer-handling path, not a memory corruption issue with code execution potential.

Impact

An attacker gains denial of service: the recursor process crashes and stops answering queries. There is no stated confidentiality or integrity impact, so this is availability-only.

Attack surface

Reachable over the network by sending DNS responses or queries that cause the recursor to parse a crafted authoritative answer with a non-IN-class CNAME. No authentication and no user interaction are required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware association is recorded in this entry, but EPSS is high at roughly 0.52 (98.9th percentile), indicating elevated likelihood of attempted exploitation. References are vendor advisories and patches rather than exploit write-ups.

What to do

• Upgrade PowerDNS Recursor to 4.0.8 or later; the vendor advisory and patch references cover this fix.
• On Debian, apply the DSA-4063 update or the equivalent distribution package fix.
• If immediate patching is not possible, restrict recursor exposure to trusted clients and disable open recursion.
• Monitor the vendor advisory page for any follow-up guidance and confirm the running version after upgrade.

Detection

• Watch for recursor process crashes or restarts correlated with DNS traffic, especially repeated restarts in a short window.
• Alert on core dumps or crash logs from pdns_recursor and inspect the failing query/answer for CNAME records with a class other than IN.
• Baseline recursor query volume and flag sudden drops in answered queries that coincide with process termination.
• Log and review inbound DNS responses containing unusual record classes reaching the recursor.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.