pdns-recursor - Debian Package Tracker

general

source: pdns-recursor (main)
version: 5.4.8-1
maintainer: pdns-recursor packagers (DMD)
uploaders: Marc Haber [DMD] – Chris Hofstaedtler [DMD]
arch: any
std-ver: 4.5.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.4.2-3
oldstable: 4.8.8-1+deb12u1
old-sec: 4.8.8-1+deb12u1
stable: 5.2.11-0+deb13u1
stable-sec: 5.2.13-0+deb13u1
testing: 5.4.6-2
unstable: 5.4.8-1

versioned links

4.4.2-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.8.8-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.2.11-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.2.13-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.4.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

pdns-recursor (3 bugs: 0, 3, 0, 0)

action needed

A new upstream version is available: 5.5.0-alpha1 high

A new upstream version 5.5.0-alpha1 is available, you should consider packaging it.

Created: 2026-10-23 Last update: 2026-10-24 00:30

8 security issues in trixie high

There are 8 open security issues in trixie.

7 important issues:

CVE-2026-73205:
CVE-2026-73206:
CVE-2026-85555:
CVE-2026-85556:
CVE-2026-85557:
CVE-2026-85558:
CVE-2026-85559:

1 issue left for the package maintainer to handle:

CVE-2026-52684: (needs triaging) If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-07-24 Last update: 2026-10-22 01:01

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-52684: If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records.

Created: 2026-07-24 Last update: 2026-10-22 01:01

8 security issues in forky high

There are 8 open security issues in forky.

8 important issues:

CVE-2026-52684: If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records.
CVE-2026-73205:
CVE-2026-73206:
CVE-2026-85555:
CVE-2026-85556:
CVE-2026-85557:
CVE-2026-85558:
CVE-2026-85559:

Created: 2026-07-22 Last update: 2026-10-22 01:01

7 security issues in bookworm high

There are 7 open security issues in bookworm.

7 important issues:

CVE-2026-73205:
CVE-2026-73206:
CVE-2026-85555:
CVE-2026-85556:
CVE-2026-85557:
CVE-2026-85558:
CVE-2026-85559:

Created: 2026-10-21 Last update: 2026-10-22 01:01

8 security issues in buster high

There are 8 open security issues in buster.

3 important issues:

CVE-2023-50387: Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
CVE-2023-50868: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
CVE-2024-25583: A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected.

5 issues postponed or untriaged:

CVE-2020-14196: (postponed; to be fixed through a stable update) In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
CVE-2020-25829: (needs triaging) An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installation that always validate (dnssec=validate), and for clients requesting validation when on-demand validation is enabled (dnssec=process).
CVE-2022-27227: (needs triaging) In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4.4.8, 4.5.x before 4.5.8, and 4.6.x before 4.6.1, insufficient validation of an IXFR end condition causes incomplete zone transfers to be handled as successful transfers.
CVE-2022-37428: (needs triaging) PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query that leads to an answer with specific properties.
CVE-2023-26437: (needs triaging) Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.

Created: 2024-02-13 Last update: 2024-06-29 13:15

lintian reports 5 warnings normal

Lintian reports 5 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-03 Last update: 2026-09-03 22:30

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 5.4.8-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-10-22 06:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.5.1).

Created: 2021-08-18 Last update: 2026-10-21 21:20

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for pdns-recursor (5.4.6-2 to 5.4.8-1): Will attempt migration (Any information below is purely informational)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/pdns-recursor.html
- ∙ ∙ Autopkgtest for pdns-recursor/5.4.8-1: amd64: Pass, arm64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ Required age reduced by 3 days because of autopkgtest
- ∙ ∙ 2 days old (needed 2 days)

news

[rss feed]

[2026-10-21] Accepted pdns-recursor 5.4.8-1 (source) into unstable (Chris Hofstaedtler)
[2026-10-19] pdns-recursor 5.4.6-2 MIGRATED to testing (Debian testing watch)
[2026-10-12] Accepted pdns-recursor 5.4.6-2 (source) into unstable (Chris Hofstaedtler)
[2026-09-06] pdns-recursor 5.4.6-1 MIGRATED to testing (Debian testing watch)
[2026-09-03] Accepted pdns-recursor 5.4.6-1 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2026-08-11] pdns-recursor 5.4.5-1 MIGRATED to testing (Debian testing watch)
[2026-08-09] Accepted pdns-recursor 5.2.13-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Christian Hofstaedtler)
[2026-08-08] Accepted pdns-recursor 5.2.13-0+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Christian Hofstaedtler)
[2026-08-06] Accepted pdns-recursor 5.4.5-1 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2026-07-25] pdns-recursor 5.4.4-1 MIGRATED to testing (Debian testing watch)
[2026-07-23] Accepted pdns-recursor 5.2.12-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Christian Hofstaedtler)
[2026-07-23] Accepted pdns-recursor 5.2.12-0+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Christian Hofstaedtler)
[2026-07-22] Accepted pdns-recursor 5.4.4-1 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2026-07-01] pdns-recursor 5.4.3-1 MIGRATED to testing (Debian testing watch)
[2026-06-27] Accepted pdns-recursor 5.4.3-1 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2026-06-25] Accepted pdns-recursor 5.2.11-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Christian Hofstaedtler)
[2026-06-25] Accepted pdns-recursor 5.2.11-0+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Christian Hofstaedtler)
[2026-06-25] pdns-recursor 5.4.2-2 MIGRATED to testing (Debian testing watch)
[2026-06-21] Accepted pdns-recursor 5.4.2-2 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2026-06-08] pdns-recursor 5.4.2-1 MIGRATED to testing (Debian testing watch)
[2026-06-03] Accepted pdns-recursor 5.4.2-1 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2026-05-29] Accepted pdns-recursor 5.4.1-2 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2026-04-30] Accepted pdns-recursor 5.2.9-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Christian Hofstaedtler)
[2026-04-28] Accepted pdns-recursor 5.2.9-0+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Christian Hofstaedtler)
[2026-04-27] pdns-recursor 5.4.1-1 MIGRATED to testing (Debian testing watch)
[2026-04-22] Accepted pdns-recursor 5.4.1-1 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2026-03-20] pdns-recursor 5.4.0-1 MIGRATED to testing (Debian testing watch)
[2026-03-09] Accepted pdns-recursor 5.4.0-1 (source) into unstable (Chris Hofstaedtler) (signed by: Christian Hofstaedtler)
[2026-02-19] Accepted pdns-recursor 5.2.8-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Christian Hofstaedtler)
[2026-02-19] pdns-recursor 5.3.5-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 4
RC: 0
I&N: 4
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 5)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.4.5-1
3 bugs