CVE-2026-42004

Full vulnerability record from the local CVENow database.

Description

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

Severity

LOW

CVSS score

3.7 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-06-25 13:16:40.547000

Last modified

2026-10-25 23:10:00.167000

View original CVE JSON

{
  "id": "CVE-2026-42004",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-25T13:16:40.547",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter."
    },
    {
      "lang": "es",
      "value": "Un atacante puede enviar un registro EDNS OPT manipulado que será ignorado por las reglas de filtrado de DNSdist, pero será reescrito como un registro OPT válido cuando se inserte EDNS Client Subnet, haciendo que el backend vea la(s) opción(es) EDNS que DNSdist no filtró."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "PowerDNS",
          "product": "DNSdist",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.powerdns.com/",
          "packageName": "dnsdist",
          "modules": [
            "EDNS processing"
          ],
          "programFiles": [
            "dnsdist-ecs.cc"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "versions": [
            {
              "version": "1.9.0",
              "lessThan": "1.9.15",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.0.0",
              "lessThan": "2.0.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T13:44:02.980438Z",
          "id": "CVE-2026-42004",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-115"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html",
      "source": "[email protected]"
    }
  ]
}