CVE-2025-59023
Published: 09 February 2026
Summary
CVE-2025-59023 is a high-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Powerdns Recursor. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 0.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-21 (Secure Name/Address Resolution Service (Recursive or Caching Resolver)) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-21 mandates data origin authentication and integrity verification for recursive or caching DNS resolvers, directly preventing cache poisoning from crafted delegations or IP fragments.
SI-2 requires timely identification, testing, and installation of flaw remediation patches, directly addressing the specific vulnerability in PowerDNS Recursor.
SI-7 provides for monitoring and integrity verification of software and information, enabling detection of poisoned cached delegations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vuln enables remote exploitation of public-facing DNS recursor (T1190) to achieve name resolution poisoning via cache manipulation (T1557.001).
NVD Description
Crafted delegations or IP fragments can poison cached delegations in Recursor.
Deeper analysisAI
CVE-2025-59023 affects PowerDNS Recursor, where crafted delegations or IP fragments can poison cached delegations. Published on 2026-02-09, this vulnerability is rated 8.2 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) and is associated with CWE-294.
Remote attackers require no privileges or user interaction and can exploit it over the network with low complexity. Successful exploitation poisons the cached delegations, resulting in high integrity impact by potentially directing DNS queries to attacker-controlled servers, alongside low availability impact.
The PowerDNS security advisory (https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-06.html) provides further details on mitigation and patches.
Details
- CWE(s)