CVE-2015-1868: The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7....

Security readout for executives and security teams

CVE-2015-1868 is a denial-of-service issue in older PowerDNS Recursor and Authoritative Server versions. A remote attacker could send a specially formed DNS request that causes excessive CPU use or a crash. The main business risk is DNS service disruption, not data theft. Exposure is most likely where affected PowerDNS recursive or authoritative DNS servers accept queries from untrusted networks. Internal-only resolvers may still be exposed if compromised hosts, guests, or partner networks can send DNS queries to them. Prioritize remediation for internet-facing or business-critical DNS infrastructure. This is a service-availability risk: successful exploitation could interrupt name resolution and dependent applications, but the provided sources do not indicate data compromise or confirmed active exploitation. Mitigation focus: Upgrade Recursor to 3.6.3, 3.7.2, or later where applicable.; Upgrade Auth Server to 3.3.2, 3.4.4, or later where applicable.; Apply Debian, Fedora, or vendor-supplied PowerDNS security packages..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.