What is the CVSS score of CVE-2026-42388?

CVE-2026-42388 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-42388?

Yes, a patch is available for CVE-2026-42388. Update the affected software to the latest version immediately.

PowerDNS Recursor CVE-2026-42388

EUVD-2026-39358 MEDIUM

Improper Input Validation (CWE-20)

2026-06-25 OX

GHSA-wmff-hvrr-9ch3

Denial Of Service Recursor Suse

5.9

CVSS 3.1 · Vendor: OX

Severity by source

Vendor (OX) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Network-reachable via crafted catalog zone data with no auth to Recursor itself; AC:H for non-default catalog zone configuration requirement; pure availability crash impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 25, 2026 - 15:17 EUVD

Analysis Generated

Jun 25, 2026 - 14:16 vuln.today

DescriptionCVE.org

Incomplete validation of the SOA record present in a catalog zone might lead to a crash.

AnalysisAI

PowerDNS Recursor crashes when processing a malformed SOA record within a catalog zone, resulting in a denial of service for all DNS resolution handled by the affected instance. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network-reachable unauthenticated exploitation, but high attack complexity reflects the non-default catalog zone configuration required. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

PowerDNS Recursor is an open-source recursive DNS resolver widely used in enterprise and ISP environments. Catalog zones are a DNS provisioning mechanism (standardized in RFC 9432) enabling DNS operators to automatically manage secondary zones through a dedicated 'catalog' zone served over DNS. An SOA (Start of Authority) record is mandatory in every DNS zone and encodes serial, refresh, and TTL metadata. The vulnerability lies in incomplete validation logic when the Recursor parses SOA records encountered while processing a catalog zone - an unexpected or malformed SOA record bypasses sufficient validation and triggers a fatal crash. The CPE (cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*) spans all recorded Recursor versions with no version floor or ceiling specified in the provided data. No CWE is assigned by the reporter; based on the description the root cause class is most consistent with CWE-20 (Improper Input Validation) or CWE-476 (NULL Pointer Dereference), though this is inferred rather than confirmed.

RemediationAI

Apply the vendor-released patch per the advisory at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-08.html - the exact fix version must be confirmed from that advisory, as it was not provided in the available data. As a compensating control where immediate patching is not possible, operators should audit whether catalog zone support is actively required; if it is not, disabling catalog zone functionality removes the attack surface entirely without impacting standard recursive resolution. Disabling catalog zones may require manual zone provisioning workflows as a trade-off. Additionally, restricting which authoritative servers are trusted as catalog zone sources (via ACL or TSIG authentication on zone transfers) reduces the attacker's ability to inject a malformed SOA record. Monitor for unexpected Recursor process terminations as a detection signal.