CVE-2019-3806 Security feature bypass in pdns-recursor
Attackers can bypass Lua-based security policies in PowerDNS Recursor by sending TCP queries under specific configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-3806?
CVE-2019-3806 is a medium-severity vulnerability in Powerdns Recursor, published on 29 Jan 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.
Weakness: CWE-358
Which versions are affected by CVE-2019-3806?
It affects 1 product.
Products include Powerdns Recursor.
How do I fix CVE-2019-3806?
Upgrade to a fixed version.
Is CVE-2019-3806 being exploited?
There is no known exploitation of CVE-2019-3806 in the wild and no public exploit code.
Other vulnerabilities in Powerdns Recursor
- CVE-2009-4009 Memory corruption in n/a
- CVE-2020-10030 Memory corruption in n/a
- CVE-2025-59023 Crafted delegations or IP fragments can poison cached delegations in Recursor
- CVE-2025-59030 Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
- CVE-2023-22617 Denial of service in n/a
Sources
Also known as DEBIAN-CVE-2019-3806, GHSA-3jqp-f4vw-9c87, UBUNTU-CVE-2019-3806.