EUVD-2026-39352
GHSA-mc43-3p9f-8c28
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L
Attacker is the upstream authoritative server so PR:N, but must control a ZoneToCache-configured source and craft accepted data, so AC:H; poisoned cache affects downstream clients (S:C) with integrity impact (I:H).
Primary rating from Vendor (open-xchange).
CVSS VectorVendor: open-xchange
Lifecycle Timeline
2DescriptionCVE.org
A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.
AnalysisAI
Cache poisoning in PowerDNS Recursor allows a malicious or compromised authoritative DNS server to inject forged records by returning a crafted zone that the resolver ingests through its ZoneToCache feature. Because the poisoned data lands in the shared recursor cache, all downstream clients can be served attacker-controlled answers, enabling traffic redirection and spoofing. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 7.5 (high) rating reflects high integrity impact with a scope change but high attack complexity.
Technical ContextAI
PowerDNS Recursor is a widely used caching/recursive DNS resolver. ZoneToCache is a Recursor feature that periodically retrieves an entire DNS zone (via AXFR, HTTP, or a file) from a configured source and loads its records directly into the recursor cache, typically used to keep frequently-queried or RPZ-style zones warm. The flaw lies in how a crafted zone delivered through this ingestion path is validated before being cached: a malicious authoritative server feeding ZoneToCache can supply records that contaminate the cache. The root cause class is improper validation/trust of externally-supplied zone data being promoted into a trusted cache (a cache-poisoning weakness); no CWE was assigned in the source data, so the precise CWE is unconfirmed. The vendor tagged this 'Information Disclosure,' but the CVSS vector (I:H, C:N) and the description ('cache poisoning') indicate the dominant effect is integrity compromise rather than confidentiality loss.
RemediationAI
Upgrade PowerDNS Recursor to the fixed release identified in PowerDNS Advisory 2026-08 (https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-08.html); the exact patched version is not included in the provided data and must be taken from that advisory. As a compensating control until patched, disable or remove ZoneToCache configurations, or restrict ZoneToCache sources to authoritative servers you fully control and trust over authenticated/secured transport (for example, AXFR with TSIG or a trusted internal source) so that an attacker-controlled authoritative server cannot feed crafted zones - the trade-off is loss of the cache-warming/RPZ-via-ZoneToCache functionality for any externally-sourced zones. Where ZoneToCache pulls over the network, limit egress so the resolver only fetches zones from approved hosts.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP4 | Affected |
| SUSE Linux Enterprise Server 15 SP4-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP5 | Affected |
| SUSE Linux Enterprise Server 15 SP5-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Manager Proxy 4.3 | Affected |
| SUSE Manager Proxy LTS 4.3 | Affected |
| SUSE Manager Retail Branch Server 4.3 | Affected |
| SUSE Manager Retail Branch Server LTS 4.3 | Affected |
| SUSE Manager Server 4.3 | Affected |
| SUSE Manager Server LTS 4.3 | Affected |
| SUSE CaaS Platform 4.0 | Affected |
| SUSE Enterprise Storage 7.1 | Affected |
| SUSE Linux Enterprise Desktop 15 SP4 | Affected |
| SUSE Linux Enterprise Desktop 15 SP5 | Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Affected |
| SUSE Linux Enterprise Real Time 15 SP4 | Affected |
| SUSE Linux Enterprise Server 15 SP1-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP2-LTSS | Affected |
| SUSE Linux Enterprise Server 15 SP3-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today