PowerDNS Recursor CVE-2026-85556

Exploitation is only meaningful when EDNS Client Subnet handling is active on the recursor (operator-enabled, e.g. use-incoming-edns-subnet), since the bypassed control is the ECS hardening logic - this is a non-default deployment mode and the primary limiting factor. The attacker must additionally be able to supply DNS messages containing a crafted EDNS OPT pseudo-record whose owner name is not the root label '.', which normally requires the ability to return responses the resolver processes (a malicious/attacker-controlled authoritative server or on-path position). The impact is limited to defeating a hardening mechanism rather than directly achieving code execution or full cache poisoning.

No CVSS vector, EPSS score, KEV entry, or POC is provided in the input for CVE-2026-85556, so quantitative exploitation signals are entirely absent and risk must be inferred from the advisory text alone. The vendor (PowerDNS Security Advisory 2026-12) classifies this advisory as containing three High-severity CVEs with the remainder rated Medium or Low; the nature of this specific issue - 'Missing OPT RR owner-name validation bypasses ECS hardening' - is consistent with a lower-severity hardening-bypass rather than one of the three High items (which are more plausibly the DoS and DNSSEC/cache-poisoning issues CVE-2026-73206, CVE-2026-73205, and CVE-2026-85555). This is a defense-in-depth control bypass: the recursor fails to validate that an EDNS OPT pseudo-record carries the required root ('.') owner name (per RFC 6891), allowing the EDNS Client Subnet (ECS) hardening protections to be evaded. Because exploitation is only meaningful when ECS handling is active (a non-default, operator-enabled configuration), real-world exposure is narrower than the product's overall deployment footprint. Exploitation status: no public exploit identified at time of analysis. Authentication requirements are not confirmed from available data because no CVSS vector was supplied; the issue is reachable by remote attackers able to deliver crafted DNS messages to the resolver. Net assessment: a genuine but low-urgency fix - patch during normal maintenance, prioritizing it only if use-incoming-edns-subnet / ECS is enabled.

An attacker positioned to return DNS responses to the recursor (e.g., a malicious or attacker-influenced authoritative server, or an on-path responder) crafts a reply whose EDNS OPT record uses a non-root owner name instead of the mandatory root label. Because the recursor does not validate the OPT RR owner name, the ECS hardening logic is bypassed, letting the attacker influence how client-subnet information is processed. No public exploit code is known, and the attack is only relevant on resolvers with ECS handling enabled.