Bug 297322 - dns/powerdns-recursor: Update to 5.4.5 (fixes CVE-2026-52682 with score 7.5)
Summary: dns/powerdns-recursor: Update to 5.4.5 (fixes CVE-2026-52682 with score 7.5)
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Yusuf Yaman
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-08-06 21:29 UTC by Jordan Ostreff
Modified: 2026-08-07 14:18 UTC (History)
2 users (show)

See Also:
tremere: maintainer-feedback+
nxjoseph: merge-quarterly+

Attachments
dns/powerdns-recursor 5.4.5 (1.16 KB, patch)
2026-08-06 21:29 UTC, Jordan Ostreff 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jordan Ostreff 2026-08-06 21:29:12 UTC 
Created attachment 273513 [details]
dns/powerdns-recursor 5.4.5

Date: 2026-08-06T00:00:00+01:00
Discovery date: 2026-07-28T00:00:00+01:00
Affects: PowerDNS Authoritative Server 4.9.16, 5.0.6, 5.1.3, Recursor 5.2.12, 5.3.9, 5.4.4, and dnsdist 1.9.15, 2.0.7, 2.1.0
Not affected: PowerDNS Authoritative Server 4.9.17, 5.0.7, 5.1.4, Recursor 5.2.13, 5.3.10, 5.4.5, and dnsdist 1.9.16, 2.0.8, 2.1.1
Severity: High
Impact: Increased memory and CPU usage
Exploit: A crafted DNS packet can cause increased memory and CPU consumption
Risk of system compromise: None
Solution: Upgrade to patched version
CWE: CWE-400
CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Last affected: auth 5.1.3, 5.0.6, 4.9.16, recursor 5.2.12, 5.3.9, 5.4.4 dnsdist 1.9.15, 2.0.7, 2.1.0
First fixed: auth 5.1.4, 5.0.7, 4.9.17, recursor 5.2.13, 5.3.10, 5.4.5, dnsdist 1.9.16, 2.0.8, 2.1.1
Internal ID: 17796
A malicious server can send a crafted DNS packet that leads to increased memory and CPU use.

CVSS Score: 7.5
Comment 1 Ralf van der Enden 2026-08-07 12:34:17 UTC 
Comment on attachment 273513 [details]
dns/powerdns-recursor 5.4.5

Looks good to me. Thanks
Comment 2 commit-hook freebsd_committer freebsd_triage 2026-08-07 14:11:40 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=5279fcb8cc0c2d46d738f5492b6a71fba59caa63

commit 5279fcb8cc0c2d46d738f5492b6a71fba59caa63
Author:     Yusuf Yaman <nxjoseph@FreeBSD.org>
AuthorDate: 2026-08-07 14:08:31 +0000
Commit:     Yusuf Yaman <nxjoseph@FreeBSD.org>
CommitDate: 2026-08-07 14:10:44 +0000

    security/vuxml: Document dns/{dnsdist,powerdns,powerdns-recursor} vulnerability

    PR:             297320, 297321, 297322
    Approved by:    osa, vvd (Mentors, implicit)

 security/vuxml/vuln/2026.xml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
Comment 3 commit-hook freebsd_committer freebsd_triage 2026-08-07 14:11:40 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=a834950d9494a6ee6308bd2a4be86d7f3a948e77

commit a834950d9494a6ee6308bd2a4be86d7f3a948e77
Author:     Jordan Ostreff <jordan@ostreff.info>
AuthorDate: 2026-08-07 13:55:52 +0000
Commit:     Yusuf Yaman <nxjoseph@FreeBSD.org>
CommitDate: 2026-08-07 14:10:39 +0000

    dns/powernds-recursor: Update 5.4.4 => 5.4.5

    Changelog:
    https://doc.powerdns.com/recursor/changelog/5.4.html#change-5.4.5

    PR:             297322
    Reported by:    Jordan Ostreff <jordan@ostreff.info> (author)
    Approved by:    Ralf van der Enden <tremere@cainites.net> (maintainer)
    Approved by:    osa, vvd (Mentors, implicit)
    Security:       CVE-2026-52682
    MFH:            2026Q3

 dns/powerdns-recursor/Makefile | 2 +-
 dns/powerdns-recursor/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)
Comment 4 commit-hook freebsd_committer freebsd_triage 2026-08-07 14:15:42 UTC 
A commit in branch 2026Q3 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=eecfa3d1af0ff14e4e77e72af4464a5cf48b55f9

commit eecfa3d1af0ff14e4e77e72af4464a5cf48b55f9
Author:     Jordan Ostreff <jordan@ostreff.info>
AuthorDate: 2026-08-07 13:55:52 +0000
Commit:     Yusuf Yaman <nxjoseph@FreeBSD.org>
CommitDate: 2026-08-07 14:14:28 +0000

    dns/powernds-recursor: Update 5.4.4 => 5.4.5

    Changelog:
    https://doc.powerdns.com/recursor/changelog/5.4.html#change-5.4.5

    PR:             297322
    Reported by:    Jordan Ostreff <jordan@ostreff.info> (author)
    Approved by:    Ralf van der Enden <tremere@cainites.net> (maintainer)
    Approved by:    osa, vvd (Mentors, implicit)
    Security:       CVE-2026-52682
    MFH:            2026Q3

    (cherry picked from commit a834950d9494a6ee6308bd2a4be86d7f3a948e77)

 dns/powerdns-recursor/Makefile | 2 +-
 dns/powerdns-recursor/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)
Comment 5 Yusuf Yaman freebsd_committer freebsd_triage 2026-08-07 14:18:29 UTC 
Hi,

Thank you for the collaboration!

I have tested build in Poudriere on 14.4-RELEASE-amd64-main-f6a04b12fec6 and it seems OK.

Committed, thanks.