Executive brief
PowerDNS Recursor, a tool used by internet service providers to look up website addresses for users, contains a flaw in how it handles specific network location data. When the EDNS Client Subnet (ECS) feature is enabled, the system incorrectly stores certain 'zero-scoped' responses in its temporary memory cache. This could allow an attacker to potentially access information that should have been restricted or handled differently, though it does not directly lead to a full system takeover.
Technical details
A vulnerability exists in PowerDNS Recursor's handling of EDNS Client Subnet (ECS) data within its packet cache. Specifically, the recursor incorrectly caches answers with a zero scope (indicating the answer is global and not subnet-specific) when it should not. This issue is located in the 'EDNS Client Subnet processing' module within pdns_recursor.cc. An unauthenticated remote attacker can exploit this behavior in configurations where ECS is enabled to potentially cause the recursor to serve incorrect or sensitive cached data to other clients. The issue is addressed in versions 5.2.11, 5.3.8, and 5.4.3.
Affected products
- PowerDNS Recursor 5.2.0 to 5.2.10, 5.3.0 to 5.3.7, 5.4.0 to 5.4.2
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory