What is the CVSS score of CVE-2026-42001?

CVE-2026-42001 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of PowerDNS Authoritative are affected by CVE-2026-42001?

PowerDNS Authoritative Server is vulnerable to unauthenticated remote denial-of-service attacks through improper validation of SOA queries in the Autoprimary replication mechanism, directly…. A patch is available.

How to fix or mitigate CVE-2026-42001?

Within 24 hours: Inventory all PowerDNS Authoritative Server instances and determine whether Autoprimary replication is enabled; disable the feature if operationally feasible. Within 7 days: Deploy firewall rules restricting SOA query sources to whitelisted secondary nameserver IP addresses, implement per-source rate limiting on DNS responses, and enable real-time alerting for query volume anomalies. Within 30 days: Monitor PowerDNS Security Advisory 2026-06 for patch availability and timeline; evaluate upgrade paths or migration to alternative authoritative DNS solutions; document and test nameserver failover procedures.

PowerDNS Authoritative CVE-2026-42001

EUVD-2026-31259 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-21 OX

GHSA-mxqj-8r4c-fp83

Denial Of Service Authoritative

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

May 21, 2026 - 11:01 EUVD

Analysis Generated

May 21, 2026 - 10:45 vuln.today

DescriptionCVE.org

Insufficient Validation of Autoprimary SOA Queries

AnalysisAI

Remote denial of service in PowerDNS Authoritative Server arises from insufficient validation of SOA queries received via the Autoprimary (formerly 'supermaster') replication mechanism, allowing unauthenticated network-based attackers to disrupt service availability. The flaw carries a CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with availability-only impact, and no public exploit identified at time of analysis. The OX-reported issue is documented in PowerDNS Security Advisory 2026-06.

Technical ContextAI

PowerDNS Authoritative Server is an open-source authoritative DNS nameserver (CPE cpe:2.3:a:powerdns:authoritative) widely deployed by ISPs, hosting providers, and enterprises. The Autoprimary feature lets the server automatically provision new zones when it receives a NOTIFY/SOA query from a trusted upstream primary, removing the need to manually pre-configure each slave zone. The vulnerability lies in how incoming SOA queries within this Autoprimary code path are validated; insufficient input checks (no CWE was assigned, but the behavior aligns with improper input validation classes such as CWE-20) let a crafted SOA query disrupt the server. Because SOA handling sits in the DNS query path, the flaw is exposed wherever the authoritative service listens for DNS traffic and Autoprimary is enabled.

RemediationAI

Patch available per vendor advisory: upgrade PowerDNS Authoritative Server to the fixed release identified in PowerDNS Security Advisory 2026-06 (https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html); exact fix versions are not reproduced in the provided input, so consult the advisory for the precise build. Until you can patch, the most effective compensating control is to disable the Autoprimary feature (set autosecondary=no / remove the legacy supermaster configuration) - the side effect is that new zones can no longer be auto-provisioned and must be configured manually. If Autoprimary must remain enabled, restrict inbound DNS (UDP/TCP 53) at the network edge so that only known primary IPs can reach the authoritative server's query interface, and place the management interface behind an ACL; the trade-off is operational overhead when primaries change addresses. Do not rely on rate limiting alone, as a single malformed SOA may be sufficient to trigger the condition.