{"cve":"CVE-2016-7072","nvd":{"published":"2018-09-10T17:29:00.193","modified":"2026-06-17T00:52:32.463","status":"Modified","description":"An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400","CWE-20"],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7072","https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/","https://www.debian.org/security/2017/dsa-3764","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7072","https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/"],"products":["debian:debian_linux","powerdns:authoritative"],"source":"nvd","synced_at":"2026-10-19T20:53:14.491561039+00:00"},"epss":{"cve":"CVE-2016-7072","score":0.0615,"percentile":0.93469,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}