CVE-2024-25590 Overview
CVE-2024-25590 is a denial of service vulnerability affecting PowerDNS Recursor. An attacker who controls an authoritative DNS zone can publish specific Resource Record Sets (RRsets) that, when processed and cached repeatedly by the recursor, exhaust resources and degrade service. The vulnerability is categorized under [CWE-20] improper input validation. Exploitation requires no authentication and no user interaction, and can be triggered remotely over the network by inducing the recursor to query the attacker-controlled zone.
Critical Impact
Remote unauthenticated attackers can trigger a denial of service against PowerDNS Recursor instances by serving crafted DNS records, disrupting DNS resolution for all downstream clients.
Affected Products
- PowerDNS Recursor (see PowerDNS Security Advisory 2024-04 for affected versions)
- DNS resolver deployments using vulnerable PowerDNS Recursor builds
- Service providers and enterprises operating PowerDNS-based recursive DNS infrastructure
Discovery Timeline
- 2024-10-03 - CVE-2024-25590 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-25590
Vulnerability Analysis
The flaw lies in how PowerDNS Recursor handles certain Resource Record Sets returned by authoritative servers. When the recursor processes and caches responses containing these specific RRsets, the work performed scales disproportionately relative to the input. Repeated processing amplifies CPU and memory consumption, leading to denial of service conditions on the resolver.
The vulnerability is classified as improper input validation [CWE-20]. The recursor does not sufficiently constrain the cost of handling malformed or pathological record sets supplied by an upstream authoritative server. According to EPSS data, the vulnerability has a probability score of 0.703% as of the latest scoring.
Root Cause
The root cause is inadequate validation and bounded processing of incoming DNS RRsets within the recursor's caching pipeline. Specific record structures cause expensive operations to be performed on each lookup or cache refresh, rather than being normalized or rejected up front. Because recursors cache results, the costly operation is repeated whenever the cached entry is touched or refreshed.
Attack Vector
An attacker hosts an authoritative DNS zone containing the crafted RRsets. The attacker then induces a victim recursor to query that zone, typically by triggering lookups from any client whose traffic transits the recursor. Once the response is cached, repeated processing of the malicious set consumes CPU and memory. The attack vector is network-based, requires no privileges, and requires no user interaction. The vulnerability impacts availability only; confidentiality and integrity are not affected.
No verified public proof-of-concept code is currently associated with this CVE. Refer to the PowerDNS Security Advisory 2024-04 for vendor-provided technical detail.
Detection Methods for CVE-2024-25590
Indicators of Compromise
- Sustained high CPU utilization on PowerDNS Recursor processes without a corresponding increase in legitimate query volume
- Growing resident memory footprint of the pdns_recursor process accompanied by rising cache churn
- Elevated query latency, SERVFAIL responses, or timeouts reported by downstream clients
- Outbound queries concentrated toward an unfamiliar authoritative zone shortly before resource exhaustion
Detection Strategies
- Monitor PowerDNS Recursor metrics exposed via the built-in API and Prometheus exporter, focusing on cpu-msec, cache-entries, and answers-slow counters
- Compare query distribution per upstream zone to identify anomalous concentration toward a single authoritative origin
- Alert on recursor process restarts, OOM kills, or systemd unit failures that correlate with DNS service disruption
Monitoring Recommendations
- Centralize PowerDNS Recursor logs and metrics in a SIEM or data lake for correlation with network telemetry
- Track recursor query-per-second rates against historical baselines and flag sudden CPU-to-QPS divergence
- Capture passive DNS data to retroactively identify the attacker-controlled zones implicated in any outage
How to Mitigate CVE-2024-25590
Immediate Actions Required
- Upgrade PowerDNS Recursor to a fixed release as listed in PowerDNS Security Advisory 2024-04
- Inventory all recursive resolver instances, including container and appliance deployments, to ensure none are missed
- Restrict recursor query access to trusted client networks using allow-from to reduce exposure during the patching window
Patch Information
PowerDNS released fixed versions of Recursor addressing CVE-2024-25590. Administrators should consult the official PowerDNS Security Advisory 2024-04 and the Openwall OSS Security List Post for affected and fixed version numbers, then apply vendor packages via the standard update channel for the deployed distribution.
Workarounds
- Constrain cache size and TTLs (max-cache-entries, max-cache-ttl) to limit the impact of repeated processing of malicious cached entries
- Apply allow-from access control lists so only authorized clients can trigger outbound resolution
- Deploy resource limits via systemd (MemoryMax, CPUQuota) on the recursor unit to contain the blast radius of a successful DoS
# Configuration example - restrict recursor exposure and bound cache resources
# /etc/powerdns/recursor.conf
allow-from=10.0.0.0/8, 192.168.0.0/16
max-cache-entries=1000000
max-cache-ttl=3600
max-mthreads=2048
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
