CVE-2026-52684

{
  "id": "CVE-2026-52684",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-23T09:16:26.843",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the \nchild records are used immediately if not expired and thus valid, or the\n records are expired, and in that case not used.  So this case \ncan only happen if almost expired records are used to refresh the \nauthoritative NS records."
    },
    {
      "lang": "es",
      "value": "Si la autoridad responde muy lentamente y los registros expiran en el interín, la limitación de los TTL no se aplica por falta de datos. Esto no sucede en la resolución regular, ya que entonces los registros hijo se utilizan inmediatamente si no han expirado y, por lo tanto, son válidos, o los registros han expirado, y en ese caso no se utilizan. Así que este caso solo puede ocurrir si se utilizan registros casi expirados para actualizar los registros NS autoritativos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "PowerDNS",
          "product": "Recursor",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.powerdns.com/",
          "packageName": "pdns-recursor",
          "modules": [
            "Packet cache",
            "Record cache"
          ],
          "programFiles": [
            "rec-packetcache.cc",
            "recursor_cache.cc"
          ],
          "repo": "https://github.com/PowerDNS/pdns",
          "versions": [
            {
              "version": "0.0.0",
              "lessThan": "5.5.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T14:00:08.322568Z",
          "id": "CVE-2026-52684",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://github.com/PowerDNS/pdns/pull/17748",
      "source": "[email protected]"
    }
  ]
}