CVE-2023-22617

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, because QName minimization is used in QM fallback mode. This is fixed in 4.8.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2023/01/20/1Mailing List, Release Notes, Third Party Advisory
https://docs.powerdns.com/recursor/changelog/4.8.html#change-4.8.1Release Notes, Vendor Advisory
https://docs.powerdns.com/recursor/security-advisories/Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/01/20/1Mailing List, Release Notes, Third Party Advisory
https://docs.powerdns.com/recursor/changelog/4.8.html#change-4.8.1Release Notes, Vendor Advisory
https://docs.powerdns.com/recursor/security-advisories/Vendor Advisory

Timeline

Published: Jan 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-226187.8If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative CVE-2023-22629.8A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could CVE-2023-226207.5An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure vi CVE-2023-226217.2Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the serve CVE-2023-226225.3WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the so CVE-2023-226247.5Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.CVE-2023-226267.5PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on databa CVE-2023-226298.8An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. A CVE-2023-22637.5The Rockwell Automation Kinetix 5700 DC Bus Power Supply Series A is vulnerable to CIP fuzzing. The new ENIP connections cannot be establis CVE-2023-226304.3IzyBat Orange casiers before 20221102_1 allows SQL Injection via a getCasier.php?taille= URI.CVE-2023-226312.7PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor.CVE-2023-226322.7PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor.