Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0012

NIXPKGS-2026-0012

published on 13 Jan 2026

Permalink CVE-2025-59030

updated 4 weeks, 1 day ago by @LeSuisse Activity log

Created automatic suggestion 1 month ago
@LeSuisse accepted 4 weeks, 1 day ago
@LeSuisse published on GitHub 4 weeks, 1 day ago

Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor

An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.

Affected products

pdns-recursor

<5.1.9
<5.2.7
<5.3.3

Matching in nixpkgs

pkgs.pdns-recursor

Recursive DNS server

nixos-unstable 5.2.6
- nixpkgs-unstable 5.2.6
- nixos-unstable-small 5.2.6
nixos-25.05 5.2.6
- nixos-25.05-small 5.2.6
- nixpkgs-25.05-darwin 5.2.6

Package maintainers

@rnhmjoj Michele Guerini Rocco <rnhmjoj@inventati.org>

Upstream advisory: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html