What is the CVSS score of EUVD-2026-39356?

EUVD-2026-39356 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-39356?

Yes, a patch is available for EUVD-2026-39356. Update the affected software to the latest version immediately.

PowerDNS Recursor EUVD-2026-39356

| CVE-2026-40012 MEDIUM

Use of Cache Containing Sensitive Information (CWE-524)

2026-06-25 OX

GHSA-fmvv-f47m-6c7p

Information Disclosure Suse Powerdns Recursor

5.3

CVSS 3.1 · Vendor: OX

Severity by source

Vendor (OX) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable DNS service, no credentials needed once ECS is enabled, only partial client subnet data disclosed with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (OX).

CVSS VectorVendor: OX

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 15:17 EUVD

Analysis Generated

Jun 25, 2026 - 14:16 vuln.today

DescriptionCVE.org

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;

AnalysisAI

Improper packet cache handling in PowerDNS Recursor causes ECS zero-scoped DNS answers to be stored in the cache when they should be discarded or handled as global entries, creating an information disclosure pathway. All Recursor versions (cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*) are affected, but only deployments with EDNS Client Subnet (ECS) explicitly enabled are exposed. The CVSS score of 5.3 with a network vector and no required privileges reflects that any DNS client can trigger the improper caching behavior, though real-world impact is bounded by the non-default ECS configuration requirement. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

EDNS Client Subnet (ECS, RFC 7871) is an extension to the DNS protocol that allows recursive resolvers to include a truncated client IP prefix in upstream queries, enabling geo-aware authoritative servers to return client-optimal answers. When an authoritative server responds with an ECS scope prefix length of zero, it signals that the answer is globally valid and not dependent on any specific client subnet - these are called 'zero-scoped' answers. In a correct implementation, zero-scoped ECS answers should be stored in the cache as generic, subnet-independent entries (or not stored in the ECS-keyed portion of the cache at all). The bug in PowerDNS Recursor causes these zero-scoped answers to be improperly retained in the packet cache with ECS metadata attached, meaning subsequent cache lookups may surface responses that carry residual client subnet scope information from prior queries. The CWE classification was not assigned by the reporter, but the behavior is consistent with improper cache key management - analogous to CWE-524 (Use of Cache Containing Sensitive Information) or CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The affected component spans all versions of the Recursor product line per the wildcard CPE string.

RemediationAI

Consult the PowerDNS security advisory at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-08.html for the specific patched Recursor release version - a vendor advisory exists but the input data does not supply an exact fix version, so the precise upgrade target cannot be independently confirmed here and should be taken directly from that advisory. As an immediate compensating control, operators who do not require ECS functionality should disable it in the Recursor configuration (set use-incoming-edns-subnet=no and do not forward ECS to upstreams); this fully eliminates the vulnerable code path with no functional impact for non-ECS use cases. For deployments that require ECS for geo-aware resolution, upgrading to the patched release is the only complete remediation - disabling ECS in those environments would degrade the quality of answers returned to end users and may violate SLAs with CDN or authoritative providers. No additional network-layer compensating controls (firewall rules, port blocking) are effective since the flaw is in internal cache logic triggered by normal DNS query processing.