EUVD-2026-47931
GHSA-h7w8-vg64-36f2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable but requires adversarial DNS injection position and a wildcard CNAME/DNAME query; integrity impact only, no confidentiality or availability consequence.
Primary rating from Vendor (OX).
CVSS VectorVendor: OX
Lifecycle Timeline
2DescriptionCVE.org
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
AnalysisAI
DNSSEC validation is bypassed in PowerDNS Recursor when wildcard-synthesized answers are CNAME or DNAME record types, allowing an attacker positioned to inject forged DNS responses to circumvent cryptographic integrity guarantees. Wildcard expansion proofs - the NSEC or NSEC3 records that DNSSEC uses to prove a wildcard match is legitimate - are accepted by the recursor without verifying their signatures in this specific code path. No public exploit code has been identified at time of analysis, and EPSS data was not provided; however, the bypass of DNSSEC undermines a core trust mechanism used by resolvers to reject forged DNS data.
Technical ContextAI
PowerDNS Recursor (CPE: cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*) is a high-performance DNS recursive resolver widely deployed in enterprise networks and by ISPs. DNSSEC (RFC 4033-4035) requires that recursive resolvers validate cryptographic signatures on all DNS records, including NSEC and NSEC3 denial-of-existence records used to authenticate wildcard expansions. When a DNS zone uses wildcards (e.g., *.example.com) and a query matches that wildcard, the zone must provide an NSEC or NSEC3 proof that the queried name does not exist as a concrete record, justifying the wildcard synthesis. The vulnerability occurs specifically when the synthesized wildcard answer is a CNAME or DNAME record: PowerDNS Recursor's code path for this case omits the signature validation step on the accompanying NSEC/NSEC3 records, meaning a forged or unsigned proof is accepted as valid. No CWE identifier was assigned in NVD data, but the root cause class is best described as a logic/path error - a specific branch of the DNSSEC validation routine that fails to enforce signature checks.
RemediationAI
Consult the PowerDNS vendor advisory at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html for the exact patched version, which is not independently confirmed from the available NVD CPE data (no upper-bound version is specified). Upgrade to the vendor-released fixed version as the primary remediation. As a compensating control where patching is immediately impractical, operators may consider disabling DNSSEC validation entirely on the recursor (setting dnssec=off or dnssec=process-no-validate in recursor.conf) - however, this eliminates all DNSSEC protection and should be treated as a temporary last resort with explicit risk acceptance. Alternatively, restricting the use of wildcard CNAME or DNAME records in DNSSEC-signed zones served or queried through the affected recursor reduces the attack surface without disabling DNSSEC globally.
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of response
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. Rated high severity (CVSS 8.8), this vulne
Crafted delegations or IP fragments can poison cached delegations in Recursor. [CVSS 8.2 HIGH]
An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied
The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authori
The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth)
A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS
In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4
An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. Rated high sever
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. Rated
An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN respo
An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigge
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today