EUVD-2026-47930
GHSA-q3h2-8p56-9cg6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable validation bypass, no auth or user interaction; integrity-only forgery so I:H with C:N/A:N; AC:L kept per feed though injecting responses may raise real effort.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
AnalysisAI
DNSSEC wildcard validation bypass in PowerDNS Recursor allows an attacker controlling or spoofing DNS responses to forge signed records by supplying RRSIGs whose label count is smaller than required. Because the validator fails to reject RRSIGs with too few labels, a wildcard signature can be replayed to authenticate names it should not cover, letting an attacker present forged-but-'validated' DNS data for a signed zone. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the primary consequence is integrity (data forgery), not confidentiality or denial of service.
Technical ContextAI
PowerDNS Recursor is an open-source validating DNS resolver. DNSSEC signs record sets with RRSIG records, and each RRSIG carries a 'labels' field indicating how many labels of the owner name were used when computing the signature. This field is critical for wildcard handling: RFC 4035 requires that when the RRSIG label count is fewer than the number of labels in the owner name, the record was synthesized from a wildcard, and the resolver must verify that no closer match exists (via NSEC/NSEC3 proof of non-existence). The flaw is an improper-validation issue (conceptually CWE-347 Improper Verification of Cryptographic Signature / CWE-295-style origin-validation failure; the feed lists CWE as N/A) where an RRSIG with too few labels is accepted rather than being subjected to the mandatory wildcard-expansion checks, collapsing the trust boundary DNSSEC is meant to enforce. The affected component is the recursor's DNSSEC validation path; no CPE strings were supplied in the intelligence, so exact CPE identification relies on vendor changelog versioning.
RemediationAI
Upgrade PowerDNS Recursor to a fixed release: Vendor-released patch 5.2.12, 5.3.9, or 5.4.4 depending on your branch (see PowerDNS Advisory 2026-10 at https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html and the corresponding changelog entries). Because the bug lies in the DNSSEC validation logic itself, there is no clean configuration workaround that preserves security - disabling DNSSEC validation would remove the vulnerable code path but also removes all DNSSEC protection and is not recommended. As interim compensating controls until patching, restrict which upstream authoritative servers/forwarders the recursor will trust and limit exposure of the resolver to untrusted networks so that an attacker's ability to inject crafted RRSIG responses is reduced; note this only narrows the injection surface and does not fix the underlying acceptance of under-labeled RRSIGs. Applying the vendor patch is the only complete remediation.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today