CVE-2025-59030 - Vulnerability Details - OpenCVE

An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Powerdns	Recursor

No data.

No data.

References

Link	Providers
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html

History

Wed, 10 Dec 2025 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Powerdns Powerdns recursor
Vendors & Products		Powerdns Powerdns recursor

Tue, 09 Dec 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 09 Dec 2025 09:30:00 +0000

Type	Values Removed	Values Added
Description		An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.
Title		Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
Weaknesses		CWE-276
References		https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: OX

Published: 2025-12-09T09:15:43.645Z

Updated: 2025-12-09T14:30:16.023Z

Reserved: 2025-09-08T14:22:28.105Z

Link: CVE-2025-59030

Vulnrichment

Updated: 2025-12-09T14:30:13.387Z

NVD

Status : Awaiting Analysis

Published: 2025-12-09T16:17:59.170

Modified: 2025-12-09T18:36:53.557

Link: CVE-2025-59030

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-59030", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2025-09-08T14:22:28.105Z", "datePublished": "2025-12-09T09:15:43.645Z", "dateUpdated": "2025-12-09T14:30:16.023Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected", "modules": ["TCP NOTIFY messages handler"], "packageName": "pdns-recursor", "product": "Recursor", "programFiles": ["rec-tcp.cc"], "repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "versions": [{"lessThan": "5.3.3", "status": "affected", "version": "5.3.0", "versionType": "semver"}, {"lessThan": "5.2.7", "status": "affected", "version": "5.2.0", "versionType": "semver"}, {"lessThan": "5.1.9", "status": "affected", "version": "5.1.0", "versionType": "semver"}]}], "datePublic": "2025-12-08T10:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.</p>"}], "value": "An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2025-12-09T09:15:43.645Z"}, "references": [{"url": "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html"}], "source": {"advisory": "PowerDNS Security Advisory 2025-08", "discovery": "EXTERNAL"}, "title": "Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T14:30:11.421682Z", "id": "CVE-2025-59030", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T14:30:16.023Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59030", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T14:30:11.421682Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T14:30:13.387Z"}}], "cna": {"title": "Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor", "source": {"advisory": "PowerDNS Security Advisory 2025-08", "discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "modules": ["TCP NOTIFY messages handler"], "product": "Recursor", "versions": [{"status": "affected", "version": "5.3.0", "lessThan": "5.3.3", "versionType": "semver"}, {"status": "affected", "version": "5.2.0", "lessThan": "5.2.7", "versionType": "semver"}, {"status": "affected", "version": "5.1.0", "lessThan": "5.1.9", "versionType": "semver"}], "packageName": "pdns-recursor", "programFiles": ["rec-tcp.cc"], "collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected"}], "datePublic": "2025-12-08T10:00:00.000Z", "references": [{"url": "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.", "supportingMedia": [{"type": "text/html", "value": "<p>An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2025-12-09T09:15:43.645Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59030", "state": "PUBLISHED", "dateUpdated": "2025-12-09T14:30:16.023Z", "dateReserved": "2025-09-08T14:22:28.105Z", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "datePublished": "2025-12-09T09:15:43.645Z", "assignerShortName": "OX"}, "dataVersion": "5.2"}