Is CVE-2026-42004 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42004 being exploited in the wild.

How severe is CVE-2026-42004?

Low severity, with a CVSS score of 3.7, published 25 June 2026.

Which products and versions are affected?

Powerdns Dnsdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6.

Is there a fix for CVE-2026-42004?

A patch was published on 2026-06-25: Fixed in versions 1.9.15 and 2.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42004 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42004?

Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42004: PowerDNS DNSdist EDNS options smuggling in EDNS processing

CVE-2026-42004 · Severity: low · CVSS 3.7 · Published 2026-06-25

PowerDNS DNSdist is a load balancer used to manage and route internet traffic for DNS servers. A vulnerability exists where a specially crafted request can bypass security filtering rules when certain features are enabled. This could allow an attacker to 'smuggle' unauthorized data through the load balancer to internal backend servers, potentially bypassing intended security policies.

Technologies: Powerdns Dnsdist. Vendors: Powerdns.

Quick answers

Is CVE-2026-42004 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42004 being exploited in the wild.
How severe is CVE-2026-42004?: Low severity, with a CVSS score of 3.7, published 25 June 2026.
Which products and versions are affected?: Powerdns Dnsdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6.
Is there a fix for CVE-2026-42004?: A patch was published on 2026-06-25: Fixed in versions 1.9.15 and 2.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42004 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42004?: Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in DNSdist's EDNS processing allows for 'EDNS options smuggling.' An attacker can send a malformed EDNS OPT record that is ignored by DNSdist's initial filtering rules. However, when DNSdist performs EDNS Client Subnet (ECS) insertion, it rewrites the record into a valid format. This causes backend servers to receive and process EDNS options that were intended to be blocked or filtered by the load balancer. The issue affects versions 1.9.x (up to 1.9.14) and 2.0.x (up to 2.0.6). Users are advised to upgrade to versions 1.9.15 or 2.0.7, or disable ECS insertion as a workaround.

Affected products

PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6

Timeline

2026-04-24: other: Discovery date
2026-06-25: disclosed: Advisory published by PowerDNS
2026-06-25: patched: Fixed in versions 1.9.15 and 2.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.