CVE-2016-6172

Name	CVE-2016-6172
Description	PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-627-1, DSA-3664-1
Debian Bugs	830808

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pdns (PTS)	bullseye	4.4.1-1	fixed
	bookworm	4.7.3-2	fixed
	trixie	4.9.7-1	fixed
	forky, sid	5.0.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
pdns	source	wheezy	3.1-4.1+deb7u2	DLA-627-1
pdns	source	jessie	3.4.1-4+deb8u6	DSA-3664-1
pdns	source	(unstable)	4.0.1-1		830808

https://github.com/PowerDNS/pdns/issues/4128
Master: https://github.com/PowerDNS/pdns/pull/4133
3.4.x: https://github.com/PowerDNS/pdns/pull/4134