S4E just found a high top 10 tcp port service scan
high·Product Based Network Vulnerabilities·Updated Jan 10, 2026

CVE-2021-36754 Scanner

Targets the QTYPE 65535 query handling in PowerDNS Authoritative Server, allowing an attacker to crash the server remotely.

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, subdomain, ipv4
CostFree
2
Times Used
by S4E users
1
Assets Scanned
domains & IPs
1
Vulnerabilities Found
confirmed findings
References
CVECVE-2021-36754
7.5
CVSS

PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.

Attack Vector
-
Privileges Req.
-
User Interaction
-
Affected
n/aby n/a
n/a
Updated Aug 21, 2026View on NVD →
Detail

PowerDNS Authoritative Server is a high-performance DNS server software used by enterprises, hosting providers, and network administrators to manage domain name resolution. It supports advanced features like DNSSEC, zone transfers, and multi-tenancy, making it a critical component in many network infrastructures. The server handles millions of DNS queries daily, ensuring reliable domain resolution for users and services.

CVE-2021-36754 is a Denial of Service (DoS) vulnerability that arises from improper validation of DNS query types. Specifically, the server fails to handle a query with QTYPE 65535 correctly, leading to a crash when processing such malformed requests. This flaw exists in versions 4.5.0 to 4.5.1, where the code does not sanitize or reject this unusual QTYPE value.

The vulnerability is triggered by sending a DNS query with QTYPE 65535 to the PowerDNS Authoritative Server. The server's parser attempts to process this invalid type without proper bounds checking, causing a segmentation fault or memory corruption. This can be exploited remotely without authentication, making it a serious threat to availability.

If exploited, an attacker can crash the PowerDNS Authoritative Server, causing a complete denial of service for all domains it serves. This disrupts DNS resolution for users, potentially leading to service outages, loss of revenue, and reputational damage. Organizations relying on this server for critical operations face significant downtime risks.

Solution Advice
  • Upgrade PowerDNS Authoritative Server to version 4.5.1 or later, which includes a fix for CVE-2021-36754.
  • Apply the official patch from PowerDNS if upgrading is not immediately possible.
  • Implement network-level filtering to block DNS queries with QTYPE 65535 at the firewall or load balancer.
  • Deploy intrusion detection systems (IDS) to alert on abnormal DNS query types targeting the server.
  • Restrict access to the DNS server to trusted IP addresses only using ACLs or firewall rules.
  • Enable rate limiting on DNS queries to mitigate the impact of potential DoS attacks.
  • Monitor server logs for crashes or unusual query patterns indicative of exploitation attempts.
  • Conduct regular vulnerability scans using tools like S4E to identify and remediate similar issues promptly.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.