CVE-2018-10851

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-772

Affected software

Vendor	Product	Versions
The PowerDNS Project	pdns	3.3.0 to 4.1.4, excluding 4.1.5 and 4.0.6
The PowerDNS Project	pdns-recursor	3.2 to 4.1.4, excluding 4.1.5 and 4.0.9

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10851Issue Tracking, Third Party Advisory
https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-03.htmlVendor Advisory
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10851Issue Tracking, Third Party Advisory
https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-03.htmlVendor Advisory
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.htmlVendor Advisory

Timeline

Published: Nov 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-108527.5The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone CVE-2018-108537.8A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check CVE-2018-108545.4cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrast CVE-2018-108555.9Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used t CVE-2018-108568.8It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This resul CVE-2018-108577.5git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-ann CVE-2018-108588.8A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server cou CVE-2018-108597.5git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into CVE-2018-10867.5pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly CVE-2018-108607.5perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize CVE-2018-108618.1A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph s CVE-2018-108625.5WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war