CVE-2025-59030: recursor from 5.1.0 (inclusive), before 5.1.9 (exclusive), from 5.2.0 (inclusive), before 5.2.7 (exclusive), from…

Affected technology

recursor · from 5.1.0 (inclusive), before 5.1.9 (exclusive)
powerdns

recursor · from 5.2.0 (inclusive), before 5.2.7 (exclusive)
powerdns

recursor · from 5.3.0 (inclusive), before 5.3.3 (exclusive)
powerdns

Recursor · 5.3.0 to before 5.3.3, 5.2.0 to before 5.2.7, 5.1.0 to before 5.1.9
PowerDNS

Component: TCP NOTIFY messages handler
File: rec-tcp.cc

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.