CVE-2023-26437

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: through 4.6.5, through 4.7.4 , through 4.8.3.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264383.1External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS c CVE-2023-264397.8The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL CVE-2023-26447.8A vulnerability, which was classified as problematic, has been found in DigitalPersona FPSensor 1.0.0.1. This issue affects some unknown pro CVE-2023-264407.8The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be e CVE-2023-264415.5Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An at CVE-2023-264423.2In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attac CVE-2023-264439.8Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this ca CVE-2023-264455.4Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. M CVE-2023-264465.4The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed CVE-2023-264475.4The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not ge CVE-2023-264485.4Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script CVE-2023-264495.4The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be execute