[powerdns-essentials-announce] EMBARGO: PowerDNS Security Advisory 2026-13

[PowerDNS Essentials Announcements]

Dear customer,

A security issue in the way DNS packets using label compression are being processed affects PowerDNS Authoritative Server, in versions up to and including. 4.9.17, 5.0.7 and 5.1.4.

The description of the security issue will be posted publicly on the 21st of October 2026, with the release of PowerDNS Authoritative Server 4.9.18, 5.0.8 and 5.1.5. Until then, we kindly request you to keep this information private inside your organization.

You will also find below a password-protected link that contains:

- a patch that can be applied against 4.9.17, 5.0.7 or 5.1.4 to fix the issue.
- release tarballs for 4.9.18, 5.0.8 and 5.1.5.
- pre-built packages for 4.9.18, 5.0.8 and 5.1.5.
- full security details for the issue.
- a CSAF file containing machine-readable descriptions of the issue.

The issue fixed in these releases is:

- CVE-2026-73206
   A malicious server can send a crafted reply that leads to high resource utilization decompression name pointers in DNS packets. This is a multi-vendor issue. Multiple DNS vendors are releasing fixed version of their products.

The password-protected link is:
https://downloads.powerdns.com/pre-announce-pkgs/pnnbuDJtqSkAgH7H3sDNHHVhs/
and can be accessed using username sec202613 and
HaR7EdCzpHp734wyUA4AecD7 as password.
Please do not share this link, username or password.

Thank you,

Erik Winkels
PowerDNS.COM BV -- https://www.powerdns.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.open-xchange.com/pipermail/powerdns-essentials-announce/attachments/20261007/d06eaeaa/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 475 bytes
Desc: not available
URL: <http://lists.open-xchange.com/pipermail/powerdns-essentials-announce/attachments/20261007/d06eaeaa/attachment.sig>