CVE-2026-42004

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Un atacante puede enviar un registro EDNS OPT manipulado que será ignorado por las reglas de filtrado de DNSdist, pero será reescrito como un registro OPT válido cuando se inserte EDNS Client Subnet, haciendo que el backend vea la(s) opción(es) EDNS que DNSdist no filtró.

Information

Published : 2026-06-25 13:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-42004

Mitre link : CVE-2026-42004

CVE.ORG link : CVE-2026-42004

JSON object : View

Products Affected

No product.

CWE

CWE-115

Misinterpretation of Input

{"id": "CVE-2026-42004", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42004", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T13:44:02.980438Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@open-xchange.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@open-xchange.com", "affectedData": [{"repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "modules": ["EDNS processing"], "product": "DNSdist", "versions": [{"status": "affected", "version": "1.9.0", "lessThan": "1.9.15", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.7", "versionType": "semver"}], "packageName": "dnsdist", "programFiles": ["dnsdist-ecs.cc"], "collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected"}]}], "published": "2026-06-25T13:16:40.547", "references": [{"url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html", "source": "security@open-xchange.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-115"}]}], "descriptions": [{"lang": "en", "value": "An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist\u2019s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter."}, {"lang": "es", "value": "Un atacante puede enviar un registro EDNS OPT manipulado que ser\u00e1 ignorado por las reglas de filtrado de DNSdist, pero ser\u00e1 reescrito como un registro OPT v\u00e1lido cuando se inserte EDNS Client Subnet, haciendo que el backend vea la(s) opci\u00f3n(es) EDNS que DNSdist no filtr\u00f3."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security@open-xchange.com"}