What is the CVSS score of CVE-2026-42396?

CVE-2026-42396 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42396?

Yes, a patch is available for CVE-2026-42396. Update the affected software to the latest version immediately.

PowerDNS Authoritative CVE-2026-42396

EUVD-2026-31265 MEDIUM

Code Injection (CWE-94)

2026-05-21 OX

GHSA-hm6h-mcgv-h2x8

RCE Code Injection Powerdns Authoritative

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 23, 2026 - 16:22 NVD

4.9 (MEDIUM) 6.5 (MEDIUM)

Patch available

May 21, 2026 - 11:01 EUVD

Analysis Generated

May 21, 2026 - 10:47 vuln.today

DescriptionNVD

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail

AnalysisAI

Catalog zone transfer failure in PowerDNS Authoritative can be triggered by a high-privileged remote attacker who injects insufficiently validated member zone data, causing the catalog zone transfer mechanism to abort and preventing secondary nameservers from receiving zone updates. The impact is a targeted denial-of-service against DNS zone replication infrastructure, affecting any deployment using catalog zones (RFC 9432). No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

PowerDNS Authoritative (CPE: cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*) is a widely deployed authoritative DNS server that supports catalog zones per RFC 9432 - a mechanism where a primary server distributes zone provisioning data to secondaries via a special catalog zone. The vulnerability lies in insufficient validation of member zone data embedded within catalog zones: when malformed or unexpected member zone entries are processed, the transfer operation fails entirely rather than skipping or rejecting the bad entry. No CWE was assigned, but the root cause pattern aligns with improper input validation (CWE-20) in DNS zone data parsing. Notably, the vulnerability tag lists 'Information Disclosure,' which is inconsistent with the CVSS impact metrics showing C:N/I:N/A:H - this discrepancy warrants verification against the vendor advisory.

RemediationAI

Consult the official PowerDNS advisory (powerdns-2026-06) at https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html for the specific patched version and upgrade path. An exact fix version number is not independently confirmed from available input data - the advisory must be treated as authoritative. As a compensating control prior to patching, restrict write and provisioning access to catalog zone data to the minimum set of trusted administrative accounts, reducing the pool of principals capable of injecting malformed member zone entries. Additionally, operators not using catalog zone functionality can disable it to eliminate the attack surface entirely, with the trade-off of losing automated secondary provisioning capabilities.