What is the CVSS score of CVE-2026-42389?

CVE-2026-42389 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-42389?

Yes, a patch is available for CVE-2026-42389. Update the affected software to the latest version immediately.

PowerDNS Recursor CVE-2026-42389

EUVD-2026-39388 MEDIUM

Improper Input Validation (CWE-20)

2026-06-25 OX

GHSA-hrq7-vr6r-5mvq

Information Disclosure Suse Powerdns Recursor

5.3

CVSS 3.1 · Vendor: OX

Severity by source

Vendor (OX) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

AC:H applied because reliable exploitation requires attacker control of or on-path interception of authoritative DNS responses, not trivial remote access.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 15:17 EUVD

Analysis Generated

Jun 25, 2026 - 14:38 vuln.today

DescriptionCVE.org

This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers.

AnalysisAI

DNS response manipulation in PowerDNS Recursor 5.4.x allows network-positioned attackers to inject false DNS records through insufficient validation of answers received from authoritative servers, resulting in low-integrity violations in name resolution for downstream clients. The 5.4.x branch received hardening patches per PowerDNS advisory 2026-08 to close this validation gap. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

PowerDNS Recursor (CPE: cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*) is an open-source recursive DNS resolver that iteratively contacts authoritative servers on behalf of clients and caches results. The vulnerability exists in the 5.4.x branch where incoming DNS wire-format responses from authoritative servers were not subjected to sufficient validation before being processed or forwarded - a class of flaw typically associated with CWE-20 (Improper Input Validation), though no CWE was formally assigned. Attack surface for this class includes out-of-bailiwick record injection, crafted RDATA fields, or malformed answer sections that the resolver accepts without adequate sanitization. The 'Information Disclosure' tag applied by reporter OX (Open-Xchange) introduces a minor discrepancy with the CVSS C:N metric, suggesting either a secondary leakage vector not described in the available advisory text or a broad classification convention used by the reporter - this cannot be resolved without the full advisory content.

RemediationAI

Patch available per vendor advisory. The PowerDNS advisory 2026-08 (https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-08.html) describes the fix for the 5.4.x branch; the exact patched release version was not independently confirmed from the data provided and must be obtained from the advisory directly. As an interim compensating control, ensuring DNSSEC validation is enabled and fully enforced on the Recursor instance provides cryptographic verification of DNS responses independent of this flaw, significantly raising the bar for response manipulation attacks. Additionally, restricting the recursor's outbound DNS communication to trusted upstream paths via firewall policy can reduce exposure to responses from malicious authoritative servers, though this may degrade resolution of legitimate domains not reachable via those paths - weigh availability trade-offs accordingly.