What is the CVSS score of CVE-2026-42390?

CVE-2026-42390 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-42390?

Yes, a patch is available for CVE-2026-42390. Update the affected software to the latest version immediately.

PowerDNS Recursor CVE-2026-42390

EUVD-2026-39359 MEDIUM

Improper Input Validation (CWE-20)

2026-06-25 OX

GHSA-3r7g-67q5-53gf

Information Disclosure Suse Powerdns Recursor

5.3

CVSS 3.1 · Vendor: OX

Severity by source

Vendor (OX) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

AC:H applied because exploitation requires non-default ZoneToCache+ZONEMD configuration and attacker positioning to supply a crafted zone; no auth, confidentiality, or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 15:17 EUVD

Analysis Generated

Jun 25, 2026 - 14:35 vuln.today

DescriptionCVE.org

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.

AnalysisAI

ZONEMD validation bypass in PowerDNS Recursor allows a cryptographically invalid DNS zone to be accepted as legitimate when ZoneToCache is configured with ZONEMD validation enabled. This undermines the integrity guarantee that ZONEMD is designed to provide - an attacker capable of serving a crafted zone to the resolver (e.g., via a rogue authoritative source or network interception) can cause the recursor to cache and serve tampered DNS data. No public exploit code has been identified and exploitation is not confirmed in CISA KEV; real-world risk is constrained by the non-default configuration prerequisite.

Technical ContextAI

ZONEMD, standardized in RFC 8976, embeds a cryptographic digest within a DNS zone to allow consumers to verify the zone's complete integrity before use. PowerDNS Recursor's ZoneToCache feature enables the resolver to periodically fetch and locally cache entire DNS zones, serving them with authoritative-like authority. When ZONEMD validation is activated within ZoneToCache, the recursor should reject any zone whose digest does not match its contents. The flaw causes the validation routine to return a passing result for certain invalid zones - most likely a logic error in digest computation, comparison, or zone parsing, as no CWE has been formally assigned. The affected product is identified by CPE cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*, indicating a broad version range; exact affected and fixed versions are enumerated in the vendor advisory.

RemediationAI

Upgrade PowerDNS Recursor to the patched version identified in the vendor advisory at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-08.html - the exact fixed version number is not independently confirmed in available data and must be verified from that source. For deployments unable to patch immediately, disabling ZONEMD validation within the ZoneToCache configuration eliminates the vulnerable code path entirely; this trade-off removes cryptographic integrity checking for cached zones, which may be acceptable temporarily if zone sources are otherwise trusted and access-controlled. Additionally, restricting ZoneToCache zone sources to authoritative servers under direct operator control reduces the likelihood that a malformed zone could be injected, though this is a defense-in-depth measure rather than a complete fix.