CVE-Katalog

CVE-2025-30192

pdns-recursor affected and fixed versions

An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. The updated version include various mitigations against spoofing attempts of ECS enabled queries by chaining ECS enabled requests and enforcing stricter validation of the received answers. The most strict mitigation done when the new setting outgoing.edns_subnet_harden (old style name edns-subnet-harden) is enabled.

Schweregrad: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Jul 21, 2025, 12:49:31 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.27% · Oct 27, 2026

Projects and upstream resources

[pdns][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	pdns-recursor	`5.2.13-0+deb13u1`	Fixed	[CVE-2025-30192]
Debiantrixie	pdns-recursor	`5.2.13-0+deb13u1`	Fixed	[CVE-2025-30192]
Debiantrixie	pdns-recursor	`5.2.4-2`	FixedDistribution-reported fixed boundary	[CVE-2025-30192]
Debiansid	pdns-recursor	`5.2.4-2`	FixedDistribution-reported fixed boundary	[CVE-2025-30192]
Debiansid	pdns-recursor	`5.4.9-1`	Fixed	[CVE-2025-30192]
Debianforky	pdns-recursor	`5.2.4-2`	FixedDistribution-reported fixed boundary	[CVE-2025-30192]
Debianforky	pdns-recursor	`5.4.8-1`	Fixed	[CVE-2025-30192]

Showing 7 fix observations. All 12 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	pdns-recursor	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	pdns-recursor	Not reported	AffectedDistribution reports no fix	[CVE-2025-30192]
Debianbookworm	pdns-recursor	`4.8.8-1+deb12u1`	Affected	[CVE-2025-30192]
Debianbookworm-security	pdns-recursor	`4.8.8-1+deb12u1`	Affected	[CVE-2025-30192]
Debianforky	pdns-recursor	`5.2.4-2`	FixedDistribution-reported fixed boundary	[CVE-2025-30192]
Debianforky	pdns-recursor	`5.4.8-1`	Fixed	[CVE-2025-30192]
Debiansid	pdns-recursor	`5.2.4-2`	FixedDistribution-reported fixed boundary	[CVE-2025-30192]
Debiansid	pdns-recursor	`5.4.9-1`	Fixed	[CVE-2025-30192]
Debiantrixie	pdns-recursor	`5.2.13-0+deb13u1`	Fixed	[CVE-2025-30192]
Debiantrixie	pdns-recursor	`5.2.4-2`	FixedDistribution-reported fixed boundary	[CVE-2025-30192]
Debiantrixie-security	pdns-recursor	`5.2.13-0+deb13u1`	Fixed	[CVE-2025-30192]
Opensusetumbleweed	pdns-recursor	`5.2.5-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2025:15478-1]Mar 23, 2026, 4:53:49 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "pdns-recursor",
      "status": "fixed",
      "release": "sid",
      "version": "5.4.9-1"
    },
    {
      "name": "pdns-recursor",
      "status": "fixed",
      "release": "forky",
      "version": "5.4.8-1"
    },
    {
      "name": "pdns-recursor",
      "status": "fixed",
      "release": "trixie",
      "version": "5.2.13-0+deb13u1"
    },
    {
      "name": "pdns-recursor",
      "status": "fixed",
      "release": "trixie-security",
      "version": "5.2.13-0+deb13u1"
    },
    {
      "name": "pdns-recursor",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "4.8.8-1+deb12u1"
    },
    {
      "name": "pdns-recursor",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "4.8.8-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1109808,
      "name": "pdns-recursor",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5.2.4-2"
    },
    {
      "bug": 1109808,
      "name": "pdns-recursor",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "5.2.4-2"
    },
    {
      "bug": 1109808,
      "name": "pdns-recursor",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5.2.4-2"
    },
    {
      "bug": 1109808,
      "name": "pdns-recursor",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "end-of-life",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "pdns-recursor",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "pdns-recursor",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.5-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2025:15478-1",
      "fixed_version": "5.2.5-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2025:15478-1",
      "provider_updated_at": "2026-03-23T04:53:49.972536Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1109808]

OpenFactory catalog packages

Die Paketzuordnung läuft.

[Debian 12 (Bookworm)]

[pdns-recursor]Unbekannt
Details (4)
- 4.8.8-1+deb12u1 · amd64 · bookworm
  Betroffen
  dsa · pdns-recursor · debian · bookworm; dsa · pdns-recursor · debian · 12
- 4.8.8-1+deb12u1 · arm64 · bookworm
  Betroffen
  dsa · pdns-recursor · debian · bookworm; dsa · pdns-recursor · debian · 12
- 4.8.8-1+deb12u1 · amd64 · bookworm-security
  Betroffen
  dsa · pdns-recursor · debian · bookworm; dsa · pdns-recursor · debian · 12
- 4.8.8-1+deb12u1 · arm64 · bookworm-security
  Betroffen
  dsa · pdns-recursor · debian · bookworm; dsa · pdns-recursor · debian · 12

[Debian 13 (Trixie)]

[pdns-recursor]Unbekannt
Details (4)
- 5.2.11-0+deb13u1 · amd64 · trixie
  Behoben · Behoben: 5.2.4-2
  dsa · pdns-recursor · debian · 13
- 5.2.11-0+deb13u1 · arm64 · trixie
  Behoben · Behoben: 5.2.4-2
  dsa · pdns-recursor · debian · 13
- 5.2.13-0+deb13u1 · amd64 · trixie-security
  Behoben · Behoben: 5.2.4-2
  dsa · pdns-recursor · debian · 13
- 5.2.13-0+deb13u1 · arm64 · trixie-security
  Behoben · Behoben: 5.2.4-2
  dsa · pdns-recursor · debian · 13

[openSUSE Tumbleweed]

[pdns-recursor]Unbekannt
Quellpaket: [pdns-recursor]
Details (1)
- 5.2.5-2.9 · x86_64 · tumbleweed
  Behoben · Behoben: 5.2.5-1.1
  dsa · pdns-recursor · opensuse · tumbleweed

Beobachtet: Oct 27, 2026, 12:54:20 PM UTC

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]