PowerDNS Recursor CVE-2026-42390

Exploitation is conditioned on two non-default requirements that must both be true simultaneously: the PowerDNS Recursor instance must have the ZoneToCache feature explicitly configured, and ZONEMD validation must be enabled within that configuration. Neither setting is active in a default installation. Beyond configuration, the attacker must be positioned to deliver a crafted invalid zone to the recursor - for example, by controlling the authoritative zone source or occupying a man-in-the-middle position on the network path used for zone retrieval. Exploitation is limited to the integrity plane (I:L): there is no code execution, no credential exposure, and no denial-of-service impact. The absence of C or A impact (C:N/A:N in CVSS) further constrains the blast radius to DNS data integrity within the specifically cached zones.

The CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects a network-reachable, unauthenticated integrity bypass with limited impact. However, NVD's AC:L may overstate attacker ease - exploiting this flaw requires both a non-default deployment configuration (ZoneToCache with ZONEMD validation explicitly enabled) and the attacker being positioned to supply a malformed zone to the resolver, which narrows the realistic attack surface considerably. No EPSS score was provided in available intelligence; no CISA KEV listing and no POC exist at time of analysis. SSVC signals suggest low exploitation probability given deployment complexity and absence of public exploit material. The integrity impact, accepting tampered zone data, could have downstream consequences for client DNS resolution (e.g., serving attacker-influenced records), but only within the zones explicitly configured for ZoneToCache. Deployments not using this feature are entirely unaffected. This is a meaningful finding for operators specifically relying on ZONEMD for zone integrity assurance, but a low-priority item for the broader PowerDNS Recursor install base.

An attacker controlling a zone source configured in ZoneToCache - either by operating a rogue authoritative server or by intercepting the zone transfer between the resolver and its configured source - serves a crafted zone whose ZONEMD digest does not match its contents. The PowerDNS Recursor's faulty validation logic accepts the zone as intact, caching and subsequently serving the tampered DNS data to downstream clients. No public POC has been identified; this attack requires both configuration-specific conditions and network positioning relative to the zone retrieval path.