CVE-2024-25583: DNS Recursor DoS Vulnerability

CVE-2024-25583 Overview

CVE-2024-25583 affects the PowerDNS Recursor when configured to use recursive forwarding to an upstream server. A crafted response from that upstream server can trigger a Denial of Service condition in the Recursor process. The default Recursor configuration does not enable recursive forwarding and is not affected by this issue. The vulnerability is tracked under CWE-20: Improper Input Validation and was published to the National Vulnerability Database on April 25, 2024.

Critical Impact
An attacker controlling or able to influence an upstream resolver can crash or stall PowerDNS Recursor instances configured with forward-recurse, disrupting DNS resolution for all downstream clients.

Affected Products

PowerDNS Recursor instances configured with recursive forwarding (forward-recurse)
Deployments using upstream resolvers that are not fully trusted
Environments running Recursor versions prior to the fixes referenced in the PowerDNS Security Advisory 2024-02

Discovery Timeline

2024-04-24 - Public disclosure via the Openwall oss-security mailing list
2024-04-25 - CVE-2024-25583 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25583

Vulnerability Analysis

The vulnerability resides in the PowerDNS Recursor's handling of responses received from upstream servers when recursive forwarding is enabled. When forward-recurse directs the Recursor to delegate recursion to another resolver, the Recursor must parse and validate responses returned by that upstream. A specifically crafted response causes the Recursor to enter a state that produces a Denial of Service, impacting availability for all clients depending on the resolver.

The issue is categorized as Improper Input Validation [CWE-20]. The Recursor does not adequately constrain or validate certain fields or structures within upstream responses before processing them. The default Recursor deployment performs full recursion itself and never enters the vulnerable code path, which is why operators using stock configurations are not exposed.

Root Cause

The root cause is insufficient validation of upstream DNS response data along the recursive-forwarding code path. Inputs that should be rejected or bounded are instead handed to downstream processing logic, producing a fatal condition in the resolver process. Because DNS resolvers are typically long-lived service processes serving many clients, a single crash or hang propagates into a broad outage for the network segment they serve.

Attack Vector

Exploitation requires the Recursor to be configured with recursive forwarding to an upstream resolver. An attacker who controls that upstream server, or who can inject responses along the path (for example, through an on-path position or by compromising the configured forwarder), can deliver the crafted response. The attack is network-based, requires no authentication, and no user interaction. The impact is limited to availability, with no direct confidentiality or integrity loss.

No verified public proof-of-concept code is available. Refer to the PowerDNS Security Advisory 2024-02 for vendor-provided technical detail.

Detection Methods for CVE-2024-25583

Indicators of Compromise

Unexpected restarts, crashes, or hangs of the pdns_recursor service on hosts configured with forward-recurse
Sudden spikes in DNS resolution failures (SERVFAIL) or client-side timeouts originating from the affected resolver
Anomalous DNS response patterns from configured upstream forwarders, including malformed records or oversized fields

Detection Strategies

Audit Recursor configuration files for the presence of forward-recurse or equivalent directives that delegate recursion to an upstream resolver
Correlate process termination events for pdns_recursor with inbound DNS traffic from configured upstreams to identify response-triggered failures
Inspect DNS telemetry for malformed or non-compliant responses from forwarders and compare against the vendor advisory's response patterns

Monitoring Recommendations

Enable health monitoring and automatic restart alerts on the Recursor service, and forward systemd or init logs to a central log store
Capture full DNS query and response pairs at the resolver boundary using tools such as dnstap for forensic review after a service interruption
Alert on sustained increases in resolver error rates, query backlog depth, or socket queue saturation

How to Mitigate CVE-2024-25583

Immediate Actions Required

Upgrade PowerDNS Recursor to the fixed version listed in the PowerDNS Security Advisory 2024-02
Review all Recursor configurations and remove forward-recurse directives that are not strictly required for operations
Restrict the set of upstream forwarders to known, trusted resolvers under administrative control

Patch Information

PowerDNS released patched Recursor builds addressing CVE-2024-25583. Operators should consult the PowerDNS Security Advisory 2024-02 for the exact fixed version numbers corresponding to their release branch, and apply distribution packages or upstream builds containing those fixes. The Openwall announcement summarizes the issue for downstream packagers.

Workarounds

Disable recursive forwarding and allow the Recursor to perform full recursion itself, which is the default and unaffected configuration
If forwarding is required, point forward-recurse only at resolvers within a trusted administrative boundary
Apply network-layer controls to ensure only the intended upstream resolvers can return traffic to the Recursor's source port

bash

# Example: disable recursive forwarding in recursor.conf
# Comment out or remove forward-recurse entries
# forward-zones-recurse=.=192.0.2.53

# Verify configuration and restart the service
rec_control reload-zones
systemctl restart pdns-recursor