CVE-2026-52684

Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-52686

Wildcard CNAME proof validation bypass

The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-52688

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-42388

Missing input validation for catalog zones

Incomplete validation of the SOA record present in a catalog zone might lead to a crash.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-52690

Spoofed answers can mark an authoritative non-EDNS capable

Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-42389

Reject more queries with invalid header values

This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-33612

ZoneToCache can poison the cache

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-40012

Information about ECS zero scoped answers might leak to clients that use a specific ECS

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-42387

Insufficient input validation in ZoneToCache

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-42390

ZONEMD validation can be bypassed

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-33261

Null pointer accces in aggressive NSEC(3) cache

A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-33260

Insufficient input validation of internal webserver

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Authoritative Dnsdist Recursor

CVE-2026-33258

Crafted zones can cause increased resource usage

By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-33256

Unbounded memory allocation by internal web server

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-33257

Insufficient input validation of internal webserver

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Authoritative Dnsdist Recursor

CVE-2026-33259

Concurrent modification of RPZ data can lead to denial of servce

Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally concurrent transfers of the same RPZ zone can only occur with a malfunctioning RPZ provider.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-33262

Insufficient validation of cookie reply

An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service. Cookies are disabled by default.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-33600

Null pointer dereference in RPZ transfer

An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2026-33601

Insufficient validation of zonemd record

If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of service.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns

Products

Recursor

CVE-2008-1637

pdns-recursor: perdictable query ids

PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it easier for remote attackers to poison a DNS cache, related to (a) algorithmic deficiencies in rand and random functions in external libraries, (b) use of a 32-bit seed value, and (c) choice of the time of day as the sole seeding information.

CVSS 2.0 · 6.8 Medium EPSS 4.0% KEV · Not listed

Vendors

Powerdns

Products

Recursor