What is the CVSS score of CVE-2026-42000?

CVE-2026-42000 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of PowerDNS Authoritative are affected by CVE-2026-42000?

PowerDNS Authoritative DNS server versions 4.9.0-4.9.14 and 5.0.0-5.0.4 are vulnerable to denial-of-service attacks through malicious zone transfer data that could disrupt DNS service availability.. A patch is available.

How to fix or mitigate CVE-2026-42000?

Within 24 hours, identify and inventory all PowerDNS Authoritative DNS server instances running versions 4.9.0-4.9.14 or 5.0.0-5.0.4 across your infrastructure. Within 7 days, obtain and deploy the latest patched PowerDNS version from the vendor, prioritizing production DNS servers to minimize service disruption. Within 30 days, verify complete deployment through vulnerability scanning to confirm no instances remain on vulnerable versions.

PowerDNS Authoritative CVE-2026-42000

EUVD-2026-31261 HIGH

Command Injection (CWE-77)

2026-05-21 OX

GHSA-cmjg-f724-5qh3

Command Injection Powerdns Authoritative

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

8.6 HIGH

Reached over the network via AXFR with no auth or UI on the vulnerable path; availability-only impact with a scope change to the DNS service, matching the vendor vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

SUSE

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 16:49 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 23, 2026 - 16:48 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

Jul 23, 2026 - 16:22 NVD

6.8 (MEDIUM) 8.6 (HIGH)

Patch available

May 21, 2026 - 11:01 EUVD

Analysis Generated

May 21, 2026 - 10:47 vuln.today

DescriptionNVD

Insufficient Validation of Names During AXFR

AnalysisAI

Denial of service in PowerDNS Authoritative DNS server (versions 4.9.0-4.9.14 and 5.0.0-5.0.4) arises from insufficient validation of names processed during AXFR zone transfers, letting a malicious or compromised primary send crafted zone data that disrupts availability. The CVSS 3.1 base score is 8.6 with a scope change (S:C) and availability-only impact (A:H), and no public exploit has been identified at time of analysis. EPSS is 0.00% and CISA SSVC rates exploitation as 'none', indicating no observed real-world attacks despite the high score.

Technical ContextAI

PowerDNS Authoritative is a widely used open-source authoritative DNS server that can act as a secondary (slave), pulling zone data from a primary via AXFR - a full zone transfer defined in RFC 5936. The flaw is in how the server validates domain names contained in records received during an AXFR. Although the advisory carries CWE-77 (Command Injection) and a 'Command Injection' tag, the published CVSS vector reflects availability-only impact (C:N/I:N/A:H) with a scope change, which is more consistent with a name-parsing/validation fault causing a crash or service disruption than with true OS command execution. The affected component is confirmed via CPE cpe:2.3:a:powerdns:authoritative and pertains specifically to the AXFR ingestion path used by secondary servers.

RemediationAI

Upgrade to a fixed release: PowerDNS Authoritative 4.9.15 for the 4.9.x branch or 5.0.5 for the 5.0.x branch (Vendor-released patch: 4.9.15 / 5.0.5), per the vendor advisory at https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html. Because exploitation is through the AXFR ingestion path on secondaries, the most effective compensating control until patching is to restrict AXFR to explicitly trusted primaries - use allow-axfr-ips and TSIG-authenticated transfers so secondaries only pull zones from primaries you fully control, which removes exposure to arbitrary hostile zone data at the cost of tighter transfer configuration. Additionally, firewall inbound AXFR so untrusted networks cannot reach the transfer path, accepting that this does not help if the primary itself is compromised. Do not rely on these controls as a permanent substitute for the patch.