Debian Moves PowerDNS Recursor to 5.4 to Address Seven Vulnerabilities
Tech GuruQuick Answer
Upgrade Debian trixie pdns-recursor to 5.4.9-1~deb13u1 through the security repository. Treat the 5.2-to-5.4 transition as a configuration and behavior change.
Confirm Scope And Apply The Supported Remediation
What to do now: Identify Debian trixie recursive DNS servers, installed package versions, forwarders, DNSSEC policy, access controls and service owners. Confirm that the deployed service is pdns-recursor on the Debian trixie package stream. Do not extend this package advisory to every PowerDNS product or Debian release. Read the upstream 5.2-to-5.3 and 5.3-to-5.4 upgrade guidance, test configuration compatibility, then install Debian package 5.4.9-1~deb13u1 through the supported security-update process. Verify the installed package and running service. Test valid and invalid DNSSEC responses, forwarding, client ACLs and monitoring; retain configuration diffs, query results and package records.
Last verified: 2026-11-15 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Debian 13 trixie pdns-recursor package |
|---|---|
| Advisory | DSA-6630-1 |
| CVEs | CVE-2026-73205, CVE-2026-73206, CVE-2026-85555, CVE-2026-85556, CVE-2026-85557, CVE-2026-85558, CVE-2026-85559 |
| Authoritative release date | 2026-11-14 20:05:48 UTC — Debian security announcement message header; the advisory heading also dates the bulletin November 14. |
| Authority revision date | No separate advisory revision date is supplied. |
| Affected versions | The Debian trixie pdns-recursor package before 5.4.9-1~deb13u1. Debian previously shipped the upstream 5.2 series, which is no longer supported upstream. |
| Fixed version | Debian trixie pdns-recursor 5.4.9-1~deb13u1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Debian does not confirm exploitation in the wild in this advisory.; no exploitation claim is inferred. |
What Changed
Debian issued DSA-6630-1 for seven flaws that can cause denial of service or bypass DNSSEC validation. Because backporting was not feasible, the security update moves trixie from PowerDNS Recursor 5.2 to the 5.4 series.
What To Validate Now
- Inventory. Identify Debian trixie recursive DNS servers, installed package versions, forwarders, DNSSEC policy, access controls and service owners.
- Establish applicability. Confirm that the deployed service is pdns-recursor on the Debian trixie package stream. Do not extend this package advisory to every PowerDNS product or Debian release.
- Remediate. Read the upstream 5.2-to-5.3 and 5.3-to-5.4 upgrade guidance, test configuration compatibility, then install Debian package 5.4.9-1~deb13u1 through the supported security-update process.
- Validate. Verify the installed package and running service. Test valid and invalid DNSSEC responses, forwarding, client ACLs and monitoring; retain configuration diffs, query results and package records.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The upgrade notes change loopback listening and web-service behavior; in 5.4 an enabled web service can become reachable without an API key where it was previously unavailable. Review listeners and access restrictions, stage resolver failover and retain a tested rollback plan.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
