# CVE-2026-42004: PowerDNS DNSdist EDNS options smuggling in EDNS processing

Source: https://junglewise.ai/threats/cve-2026-42004-powerdns-dnsdist-edns-options-smuggling-in-edns-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-42004 · Severity: low · CVSS 3.7 · Published 2026-06-25

PowerDNS DNSdist is a load balancer used to manage and route internet traffic for DNS servers. A vulnerability exists where a specially crafted request can bypass security filtering rules when certain features are enabled. This could allow an attacker to 'smuggle' unauthorized data through the load balancer to internal backend servers, potentially bypassing intended security policies.

Technologies: [Powerdns Dnsdist](https://junglewise.ai/threats/technologies/dnsdist). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-42004 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42004 being exploited in the wild.

**How severe is CVE-2026-42004?** Low severity, with a CVSS score of 3.7, published 25 June 2026.

**Which products and versions are affected?** Powerdns Dnsdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6.

**Is there a fix for CVE-2026-42004?** A patch was published on 2026-06-25: Fixed in versions 1.9.15 and 2.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42004 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-42004?** Check whether you run Powerdns Dnsdist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in DNSdist's EDNS processing allows for 'EDNS options smuggling.' An attacker can send a malformed EDNS OPT record that is ignored by DNSdist's initial filtering rules. However, when DNSdist performs EDNS Client Subnet (ECS) insertion, it rewrites the record into a valid format. This causes backend servers to receive and process EDNS options that were intended to be blocked or filtered by the load balancer. The issue affects versions 1.9.x (up to 1.9.14) and 2.0.x (up to 2.0.6). Users are advised to upgrade to versions 1.9.15 or 2.0.7, or disable ECS insertion as a workaround.

## Affected products

- PowerDNS DNSdist 1.9.0 to 1.9.14, 2.0.0 to 2.0.6

## Timeline

- 2026-04-24: other: Discovery date
- 2026-06-25: disclosed: Advisory published by PowerDNS
- 2026-06-25: patched: Fixed in versions 1.9.15 and 2.0.7

## References

- [https://repo.powerdns.com/](https://repo.powerdns.com/)
- [https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html](https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html)

## Related threats

- [PowerDNS DNSdist denial of service in DNS over HTTP/3](https://junglewise.ai/threats/cve-2026-40211-powerdns-dnsdist-denial-of-service-in-dns-over-http-3)
- [PowerDNS DNSdist out-of-bounds read in SetMacAddrAction](https://junglewise.ai/threats/cve-2026-40210-powerdns-dnsdist-out-of-bounds-read-in-setmacaddraction)
- [PowerDNS DNSdist denial of service via IXFR queries](https://junglewise.ai/threats/cve-2026-40209-powerdns-dnsdist-denial-of-service-via-ixfr-queries)
- [PowerDNS DNSdist denial of service in DoH3 queries](https://junglewise.ai/threats/cve-2026-40208-powerdns-dnsdist-denial-of-service-in-doh3-queries)
- [PowerDNS DNSdist denial of service in Prometheus endpoint](https://junglewise.ai/threats/cve-2026-40011-powerdns-dnsdist-denial-of-service-in-prometheus-endpoint)