First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-59023

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Crafted delegations or IP fragments can poison cached delegations in Recursor.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
PowerDNS	Recursor	>= 5.3.0, < 5.3.1; >= 5.2.0, < 5.2.6; >= 5.1.0, < 5.1.8

References

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-06.htmlVendor Advisory

Timeline

Published: Feb 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-590246.5Crafted delegations or IP fragments can poison cached delegations in Recursor.CVE-2025-590256.1Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, includi CVE-2025-590265.4Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be ex CVE-2025-590287.5When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fai CVE-2025-590295.3An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then CVE-2025-59038.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the CVE-2025-590307.5An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.CVE-2025-590314.3Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use CVE-2025-590327.5ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeated CVE-2025-590337.4The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only t CVE-2025-590344.3Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a l CVE-2025-590355.4Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, the

CVE-2025-59023: High severity, CVSS 8.2 | Vulnix