Quick answers
- Is CVE-2026-42388 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42388 being exploited in the wild.
- How severe is CVE-2026-42388?
- Medium severity, with a CVSS score of 5.9, published 25 June 2026.
- Which products and versions are affected?
- Powerdns Recursor 5.2.0 to 5.2.10, 5.3.0 to 5.3.7, 5.4.0 to 5.4.2.
- Is there a fix for CVE-2026-42388?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-42388 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-42388?
- Check whether you run Powerdns Recursor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial-of-service vulnerability exists in PowerDNS Recursor due to incomplete validation of Start of Authority (SOA) records within Catalog Zones. The flaw is located in the rec-xfr.cc component. A remote attacker could potentially trigger a service crash by providing a specially crafted SOA record in a catalog zone. The attack requires a high degree of complexity (AC:H), likely involving the ability to influence or provide catalog zone data. Affected versions include the 5.2, 5.3, and 5.4 branches; users should update to versions 5.2.11, 5.3.8, or 5.4.3 respectively.
Affected products
- PowerDNS Recursor 5.2.0 to 5.2.10, 5.3.0 to 5.3.7, 5.4.0 to 5.4.2
Timeline
- 2026-06-25: disclosed: CVE published by Open-Xchange
- 2026-06-25: advisory: PowerDNS security advisory 2026-08 released