CVE-2026-52684

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52684", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2026-06-08T08:05:31.707Z", "datePublished": "2026-07-23T07:49:04.336Z", "dateUpdated": "2026-07-23T14:00:17.742Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-07-23T07:49:04.336Z"}, "title": "Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack", "datePublic": "2026-07-19T22:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}], "affected": [{"vendor": "PowerDNS", "product": "Recursor", "collectionURL": "https://repo.powerdns.com/", "packageName": "pdns-recursor", "repo": "https://github.com/PowerDNS/pdns", "modules": ["Packet cache", "Record cache"], "programFiles": ["rec-packetcache.cc", "recursor_cache.cc"], "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "5.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the \nchild records are used immediately if not expired and thus valid, or the\n records are expired, and in that case not used. So this case \ncan only happen if almost expired records are used to refresh the \nauthoritative NS records.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>If the auth responds <em>very</em> slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the \nchild records are used immediately if not expired and thus valid, or the\n records <em>are</em> expired, and in that case not used. So this case \ncan only happen if almost expired records are used to refresh the \nauthoritative NS records.</p>"}]}], "references": [{"url": "https://github.com/PowerDNS/pdns/pull/17748"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "credits": [{"lang": "en", "value": "Taofei Guo, Peking University. Qi Wang and JianJun Chen and Haixin Duan, Tsinghua University.", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T14:00:08.322568Z", "id": "CVE-2026-52684", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T14:00:17.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52684", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T14:00:08.322568Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T14:00:14.680Z"}}], "cna": {"title": "Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Taofei Guo, Peking University. Qi Wang and JianJun Chen and Haixin Duan, Tsinghua University."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "modules": ["Packet cache", "Record cache"], "product": "Recursor", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "5.5.0", "versionType": "semver"}], "packageName": "pdns-recursor", "programFiles": ["rec-packetcache.cc", "recursor_cache.cc"], "collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected"}], "datePublic": "2026-07-19T22:00:00.000Z", "references": [{"url": "https://github.com/PowerDNS/pdns/pull/17748"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the \nchild records are used immediately if not expired and thus valid, or the\n records are expired, and in that case not used. So this case \ncan only happen if almost expired records are used to refresh the \nauthoritative NS records.", "supportingMedia": [{"type": "text/html", "value": "<p>If the auth responds <em>very</em> slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the \nchild records are used immediately if not expired and thus valid, or the\n records <em>are</em> expired, and in that case not used. So this case \ncan only happen if almost expired records are used to refresh the \nauthoritative NS records.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-07-23T07:49:04.336Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52684", "state": "PUBLISHED", "dateUpdated": "2026-07-23T14:00:17.742Z", "dateReserved": "2026-06-08T08:05:31.707Z", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "datePublished": "2026-07-23T07:49:04.336Z", "assignerShortName": "OX"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected", "modules": ["Packet cache", "Record cache"], "packageName": "pdns-recursor", "product": "Recursor", "programFiles": ["rec-packetcache.cc", "recursor_cache.cc"], "repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "versions": [{"lessThan": "5.5.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "source": "security@open-xchange.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the \nchild records are used immediately if not expired and thus valid, or the\n records are expired, and in that case not used. So this case \ncan only happen if almost expired records are used to refresh the \nauthoritative NS records."}, {"lang": "es", "value": "Si la autoridad responde muy lentamente y los registros expiran en el inter\u00edn, la limitaci\u00f3n de los TTL no se aplica por falta de datos. Esto no sucede en la resoluci\u00f3n regular, ya que entonces los registros hijo se utilizan inmediatamente si no han expirado y, por lo tanto, son v\u00e1lidos, o los registros han expirado, y en ese caso no se utilizan. As\u00ed que este caso solo puede ocurrir si se utilizan registros casi expirados para actualizar los registros NS autoritativos."}], "id": "CVE-2026-52684", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security@open-xchange.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52684", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-23T14:00:08.322568Z", "version": "2.0.3"}}]}, "published": "2026-07-23T09:16:26.843", "references": [{"source": "security@open-xchange.com", "url": "https://github.com/PowerDNS/pdns/pull/17748"}], "sourceIdentifier": "security@open-xchange.com", "vulnStatus": "Awaiting Analysis"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,5.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Recursor", "source": "cna", "vendor": "PowerDNS"}, "product": "recursor", "vendor": "powerdns"}], "created": "2026-07-23T10:30:06.801266+00:00", "updated": "2026-08-02T17:15:05.968525+00:00", "vendors": ["powerdns", "powerdns$PRODUCT$recursor"], "weaknesses": ["CWE-107", "CWE-346"]}