EUVD-2026-47932
GHSA-j58f-rgm2-v2p8
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H for the narrow attacker-controlled timing window; I:L for ghost NS record injection; C:N and A:N as no data disclosure or service disruption results.
Primary rating from Vendor (OX).
CVSS VectorVendor: OX
Lifecycle Timeline
3DescriptionCVE.org
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records.
AnalysisAI
TTL capping bypass in PowerDNS Recursor enables ghost domain NS record injection when a slow authoritative server response arrives after the cached NS entry has already expired. Specifically, the proactive background refresh mechanism fails to cap TTLs on NS record responses when no live cache entry exists at response time, allowing attacker-controlled TTL values to persist uncapped in the recursor's cache. No active exploitation has been identified (no CISA KEV listing), no public exploit code exists, and the CVSS score of 3.7 reflects the constrained, timing-dependent nature of this attack.
Technical ContextAI
PowerDNS Recursor (cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:*) implements a proactive cache refresh mechanism gated by the s_refresh_ttlperc configuration parameter. When a cached record reaches the configured TTL percentage threshold, the recursor submits a background refresh task to re-query the authoritative server before the record fully expires. The race condition exists in two code paths: RecursorPacketCache::checkResponseMatches in recpacketcache.cc, and MemRecursorCache::fakeTTD in recursor_cache.cc. For NS-type records (QType::NS), if the authoritative server responds slowly enough that the cached entry expires before the refresh response is received, the recursor has no current TTL data against which to enforce its cap. The response TTL is then accepted uncapped, enabling 'ghost domain' persistence where delegation NS records outlive their intended lifetime. No CWE was formally assigned; the root cause is a time-of-check/time-of-use (TOCTOU) race condition in cache state management. The upstream fix in PR #17748 resolves this by excluding NS record types entirely from the background refresh queue in both affected code paths.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - monitor the PowerDNS project at https://github.com/PowerDNS/pdns/pull/17748 and the official PowerDNS security advisories page for a tagged release incorporating this change. As an immediate workaround, set refresh-on-ttl-percent=0 in the PowerDNS Recursor configuration (recursor.conf) to disable the proactive background TTL refresh mechanism entirely; this eliminates the race condition at the cost of increased authoritative query load and marginally higher cache miss rates for near-expiry records, since the recursor will no longer pre-emptively refresh records before they expire. This workaround has no impact on regular resolution correctness. Operators who rely on refresh-on-ttl-percent for latency reduction should prioritize patching once a stable release is available rather than relying long-term on disabling the feature.
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . Rated high severity (CVSS 7.5), this
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. Rated high severity (CVSS 8.8)
PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE
The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records du
An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. Rated criti
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of response
dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. Rated high severity (CVSS 8.8), this vulne
Denial of service in PowerDNS Authoritative DNS server (versions 4.9.0-4.9.14 and 5.0.0-5.0.4) arises from insufficient
Out-of-bounds read in PowerDNS dnsdist allows unauthenticated remote attackers to trigger denial of service or potential
Crafted delegations or IP fragments can poison cached delegations in Recursor. [CVSS 8.2 HIGH]
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today