Vulnerabilities & updates
Fri, October 23Today
Wed, October 21
PowerDNS Recursor 5.3.13 Released
Today we have released PowerDNS Recursor 5.3.13. This release is a maintenance release that includes a single improvement:
PowerDNS Security Advisory 2026-13 for PowerDNS Authoritative Server
Today, we are releasing three new versions of the PowerDNS Authoritative Server. These 4.9.18, 5.0.8 and 5.1.5 versions provide fixes for the following PowerDNS Security Advisory:
PowerDNS Security Advisory 2026-12 for PowerDNS Recursor
Today we have released PowerDNS Recursor 5.3.12 and 5.4.8. These releases provide fixes for PowerDNS Security Advisory 2026-12 for PowerDNS Recursor: Multiple issues There are several CVEs associated with this advisory, three with severity High and the remaining with severity Medium or Low .
Mon, October 12
PowerDNS DNSdist 2.1.3 and 2.0.11 Released
Today we released DNSdist 2.1.3 and 2.0.11, fixing several issues. The notable one fixes an issue where incoming DNS over TLS and DNS over HTTPS connections could have been wrongly terminated early, when the OpenSSL provider is in use. We advise all users providing DNS over TLS or DNS over HTTPS to upgrade, but to be clear this is NOT a security issue.
Tue, October 6
Preparing for Post Quantum DNSSEC with PowerDNS
Today’s widely used DNSSEC signatures rely on mathematics that a sufficiently capable quantum computer could break. The timing of that capability remains uncertain, but changing
Thu, October 1
PowerDNS Recursor 5.3.11 and 5.4.7 Released
Today we have released PowerDNS Recursor 5.3.11 and 5.4.7. These are maintenance releases that fix bugs and include a few improvements. The most important ones are:
Tue, September 29
End of Life Announcement: Debian 11
On the 31st of August of this year (2026) Debian 11 "Bullseye" reached the end of its Long Term Support period, at which point we consider Bullseye to be End of Life. As we do not want to support our software running in unpatched environments, we have stopped building for Debian Bullseye. After the 1st of January 2027, we will start removing all repositories for this unsupported distribution from https://repo.powerdns.com/ . Users are recommended to upgrade their systems to supported operating system versions, such as Debian 12 or 13, or RHEL 9, 10, or any of the popular derivatives of RHEL.
Tue, September 22
PowerDNS DNSdist 2.0.10 Released
Today we released DNSdist 2.0.10, fixing a regression that was introduced in DNSdist 2.0.9 and was preventing dynamically blocking a suffix via the FFI interface, as done for example by DNSdist Defender.
Tue, September 15
How Much Latency Does Your Security Add?
Security has become an essential part of the connectivity experience. Subscribers expect their internet providers to deliver a connection that is fast and reliable, but also secure and protected. For operators, this creates an important challenge: How do you add security without compromising the performance your subscribers expect, and that you have worked hard to optimize?
Tue, September 8
PowerDNS DNSdist 2.1.2 and 2.0.9 Released
Today we released DNSdist 2.1.2 and 2.0.9, fixing several issues. The notable ones are:
Tue, January 30
The peculiar case of NSEC processing using expanded wildcard records
We discovered a vulnerability in the processing of wildcard synthesized NSEC records. The result was Unbound, Google public DNS, PowerDNS and Dnsmasq contained a flaw that made it possible to downgrade secure connections. While synthesis of NSEC records is allowed by RFC 4592 , these synthesized owner names should not be used in the NSEC processing. This does, however, happen in Unbound 1.6.7 and earlier versions. Ralph Dolmans wrote a blog post about the discovery and findings.