CVE-2018-16855: PowerDNS Recursor out-of-bounds read in query hash crashes resolver

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated denial of service against a core DNS service with a high EPSS score, though no confirmed in-the-wild exploitation is recorded.

What it is

PowerDNS Recursor before 4.1.8 performs an out-of-bounds memory read while hashing a DNS query for packet cache lookup. A remote attacker can trigger it with a crafted query, and the read can crash the recursor. Because the recursor is the component that answers client DNS queries, a crash takes name resolution down for everything relying on it.

Impact

An attacker gains denial of service: the recursor process can crash, interrupting DNS resolution for all clients using it. The flaw is an out-of-bounds read, so no data disclosure or code execution is described in the record.

Attack surface

Reachable over the network by sending a DNS query to the recursor; the CVSS vector shows no privileges and no user interaction required. No authentication is needed, so any host that can reach the recursor's DNS port can attempt it.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tag appears in the references, but EPSS is high (0.59469, 99th percentile), indicating elevated predicted likelihood of exploitation activity.

What to do

• Upgrade PowerDNS Recursor to 4.1.8 or later, per the vendor advisory.
• If immediate upgrade is not possible, restrict DNS service access to trusted client networks and block recursion from untrusted sources.
• Run the recursor under a supervisor or systemd with automatic restart to limit outage duration from a crash.
• Monitor the vendor advisory and distribution packages for backported fixes and apply them.
• Reduce exposure by placing recursors behind ACLs or rate limiting so arbitrary internet hosts cannot send queries directly.

Detection

• Alert on recursor process crashes, core dumps, or unexpected restarts in systemd/journal or crash logs.
• Monitor for sudden drops or gaps in DNS query/response volume from a recursor instance.
• Watch for bursts of malformed or unusual DNS queries directed at recursor hosts from single sources.
• Track recursor version inventory to find instances still below 4.1.8.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.