What is the CVSS score of CVE-2026-42387?

CVE-2026-42387 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-42387?

Yes, a patch is available for CVE-2026-42387. Update the affected software to the latest version immediately.

PowerDNS Recursor CVE-2026-42387

EUVD-2026-39357 MEDIUM

Improper Input Validation (CWE-20)

2026-06-25 OX

GHSA-9v36-5rhx-cq6m

Denial Of Service Recursor Suse

5.9

CVSS 3.1 · Vendor: OX

Severity by source

Vendor (OX) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Network vector confirmed; AC:H reflects requirement to control an authoritative server; no privileges on the Recursor itself; pure availability impact only.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 25, 2026 - 15:17 EUVD

Analysis Generated

Jun 25, 2026 - 14:16 vuln.today

DescriptionCVE.org

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.

AnalysisAI

PowerDNS Recursor crashes when a malicious authoritative DNS server serves a crafted zone via the ZoneToCache function, exploiting insufficient input validation to cause a denial of service. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms this is a remotely triggerable availability-only impact, though high attack complexity reflects the prerequisite of controlling or compromising an authoritative name server in the resolution path. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the impact on DNS infrastructure availability makes this a meaningful operational risk for affected deployments.

Technical ContextAI

PowerDNS Recursor is a caching recursive DNS resolver widely deployed in enterprise and ISP environments. The affected code path is the ZoneToCache function, which processes zone data retrieved from authoritative DNS servers - likely used in zone pre-fetching or caching optimization scenarios. The vulnerability is rooted in insufficient input validation of attacker-controlled zone content: a specially crafted zone response can trigger an unhandled condition leading to a process crash. The CPE cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:* with a wildcard version range indicates the flaw spans multiple Recursor versions. No CWE was assigned in the provided data, but the description is consistent with CWE-20 (Improper Input Validation) or potentially CWE-400 (Uncontrolled Resource Consumption), as malformed zone data causes abnormal termination rather than memory corruption.

RemediationAI

Operators should consult the official PowerDNS security advisory at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-08.html for the exact patched version number and upgrade instructions, as the provided data does not specify a confirmed fix version - stating an exact version here would be fabrication. As a compensating control, if the ZoneToCache feature is not required operationally, disabling or restricting it may reduce the attack surface; however, confirm this with PowerDNS documentation to avoid unintended resolver behavior changes. Additionally, operators can restrict which authoritative servers the Recursor is permitted to query using RPZ (Response Policy Zones) or firewall ACLs, limiting the pool of servers that can deliver malicious zone data. Monitoring for unexpected Recursor process restarts or crash dumps can serve as an early detection signal.