What is the CVSS score of EUVD-2026-31260?

EUVD-2026-31260 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-31260?

Yes, a patch is available for EUVD-2026-31260. Update the affected software to the latest version immediately.

PowerDNS Authoritative EUVD-2026-31260

| CVE-2026-42002 MEDIUM

Signal Handler Race Condition (CWE-364)

2026-05-21 OX

GHSA-vx6m-m9qv-88q3

Information Disclosure Authoritative

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

May 21, 2026 - 11:01 EUVD

Analysis Generated

May 21, 2026 - 10:46 vuln.today

DescriptionCVE.org

Concurrency and locking defects in GSS-TSIG

AnalysisAI

Concurrency and locking defects in the GSS-TSIG implementation of PowerDNS Authoritative expose the nameserver to a denial-of-service condition exploitable remotely without authentication. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the impact is limited to availability - crashing or destabilizing the authoritative DNS service - under high-complexity race condition circumstances. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.

Technical ContextAI

GSS-TSIG (Generic Security Service - Transaction SIGnature) is a DNS protocol extension that layers Kerberos/GSSAPI authentication on top of standard TSIG-signed DNS transactions. It is most commonly deployed in Active Directory-integrated DNS environments where Windows clients and servers perform authenticated dynamic DNS updates. The defect described is a concurrency and locking flaw - likely a race condition (analogous to CWE-362) or improper locking (analogous to CWE-667) - in how PowerDNS Authoritative manages concurrent GSS-TSIG sessions or shared state during negotiation or verification. No formal CWE has been assigned in the provided data. The affected product is identified via CPE cpe:2.3:a:powerdns:authoritative:*:*:*:*:*:*:*:*, where the wildcard version field indicates all tracked versions of PowerDNS Authoritative are potentially within scope. The tag 'Information Disclosure' in the source data is inconsistent with the CVSS impact scores (C:N/I:N/A:H, which indicate no confidentiality or integrity impact); this discrepancy should be verified against the vendor advisory.

RemediationAI

Consult the vendor advisory at https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html for the specific patched release version, as no exact fix version is confirmed in the available data (patch version not independently verified from this dataset). As an immediate compensating control for organizations that do not require Kerberos-authenticated dynamic DNS updates, disabling GSS-TSIG entirely removes the vulnerable code path - note that this will break authenticated DNS dynamic update workflows in Active Directory-integrated environments. If GSS-TSIG is operationally required, consider restricting access to the DNS update endpoint at the network layer to only trusted internal Kerberos infrastructure hosts, reducing exposure to the high-complexity race condition trigger. Monitor for abnormal DNS service crashes or restarts as an indicator of exploitation attempts.