What’s Vulnerable › Vulnerabilities
CVE-2026-52690: Spoofed answers can mark an authoritative non-EDNS capable
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-25 · updated 2026-10-25
- Weakness: CWE-290
Description
Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.
Affected products
- PowerDNS Recursor: from 5.2.0 before 5.2.11; from 5.3.0 before 5.3.8; from 5.4.0 before 5.4.3 — fixed in 5.2.11, 5.3.8, 5.4.3
How to fix
Upgrade to a fixed version: PowerDNS Recursor 5.2.11, 5.3.8, 5.4.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-52690 or the next vulnerability affects your stack