Severity by source
Network-delivered DNS response triggers bypass (AV:N); requires attacker-controlled authoritative server or MITM position (AC:H); no authentication needed (PR:N); DNSSEC integrity guarantee broken for downstream clients (S:C, I:L).
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
Wildcard CNAME proof validation bypass in PowerDNS Recursor allows a malicious or compromised authoritative DNS server to serve crafted responses that defeat DNSSEC validation for wildcard-expanded CNAME records, undermining the integrity guarantees DNSSEC is meant to provide. Affected versions span the 5.2.x, 5.3.x, and 5.4.x release trains, all patched on July 22, 2026. The vendor classifies this as Low severity; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Technical ContextAI
PowerDNS Recursor is a validating recursive DNS resolver. DNSSEC wildcard validation requires a resolver to confirm, via NSEC or NSEC3 denial-of-existence records, that a wildcard expansion is legitimate - including when the synthesized record is a CNAME. CVE-2026-62686 specifically concerns the proof validation step for wildcard CNAME answers: the recursor fails to correctly verify the cryptographic proof that the wildcard covers the queried name, meaning a response can pass validation despite insufficient or absent proof. This is distinct from the companion CVE-2026-52688 (High severity), which involves RRSIGs with too few labels bypassing wildcard validation. No CWE is assigned in the provided data, but the root cause class aligns with improper verification of cryptographic signatures or denial-of-existence proofs (analogous to CWE-295, Improper Certificate Validation, applied to DNSSEC proof chains). Affected CPE strings were not provided in the source data.
Affected ProductsAI
PowerDNS Recursor versions in the 5.2.x series prior to 5.2.12, the 5.3.x series prior to 5.3.9, and the 5.4.x series prior to 5.4.4 are affected. Patch release tarballs are available at downloads.powerdns.com for all three trains. The full security advisory is published at https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html. No CPE strings were provided in the source data; the exact floor version within each train (i.e., how far back 5.2.x, 5.3.x, and 5.4.x the vulnerability extends) is not confirmed from available data. Older release trains not covered by the three fixed versions should be considered end-of-life under PowerDNS's updated EOL policy.
RemediationAI
Upgrade to PowerDNS Recursor 5.2.12, 5.3.9, or 5.4.4, released July 22, 2026, which contain the fix per pull requests 17756 (5.3.x) and 17755 (5.4.x). Tarballs with signature files are available at https://downloads.powerdns.com/releases/ and packages for several distributions are available from the PowerDNS repository at https://repo.powerdns.com/. The full advisory is at https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html. No workarounds are described in the available data. As a compensating control prior to patching, operators may consider disabling DNSSEC validation temporarily (dnssec=off), though this entirely removes DNSSEC integrity guarantees and is a significant trade-off; alternatively, restrict recursive resolution to trusted upstream resolvers. Instances on release trains older than 5.2.x should migrate to a supported train, as the EOL policy no longer covers them.
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today