PowerDNS Recursor CVE-2026-52684

Exploitation requires three concurrent conditions to be satisfied simultaneously. First, the PowerDNS Recursor must be configured with refresh-on-ttl-percent (internally s_refresh_ttlperc) set to a value greater than 0 to enable proactive background NS record refresh - this is a non-default configuration that operators explicitly enable. Second, the target NS record in the recursor cache must be sufficiently near its TTL expiry to trigger a background refresh task submission. Third, the attacker must be able to introduce latency into the authoritative DNS response (e.g., by controlling or compromising the authoritative server) long enough for the cached NS entry to fully expire before the response arrives. Regular resolution - where child records are used immediately if valid, or discarded and re-queried if expired - is entirely unaffected. Exploitation is architecturally limited to the authoritative NS record background refresh path only, and requires the attacker to have influence over an authoritative name server, making opportunistic mass exploitation implausible.

The CVSS 3.7 Low score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N is well-calibrated to the actual risk. High Attack Complexity (AC:H) is fully justified by three simultaneous prerequisites: the recursor must have s_refresh_ttlperc > 0 (non-default), the target NS record must be near expiry triggering a background refresh, and the attacker must successfully delay the authoritative response past the cache entry expiry window. No EPSS data was provided in the input; no KEV listing exists; no public proof-of-concept has been identified - exploitation status is assessed as no public exploit identified at time of analysis. Real-world exploitation risk is low due to the narrow timing window and the requirement for attacker influence over an authoritative DNS server. The primary concern is environments relying on PowerDNS Recursor in configurations where s_refresh_ttlperc is enabled and where delegation accuracy is security-sensitive, such as DNSSEC-validated zones where ghost NS records could disrupt validation chains. CVSS integrity impact of Low (I:L) is appropriate - the impact is limited to incorrect DNS delegation data persisting beyond intended TTL, not full record spoofing.

An attacker controlling an authoritative name server for a target zone deliberately delays responses to PowerDNS Recursor background NS record refresh queries, timing the delay so that the recursor's cached NS entry expires before the response is received. With no live cache entry remaining, the recursor cannot enforce its TTL cap and accepts the attacker-supplied TTL verbatim, causing ghost NS records with inflated TTLs to persist in the recursor cache and misdirect subsequent delegation lookups. No public proof-of-concept code has been identified at time of analysis.