Executive brief
PowerDNS Recursor, a tool used by internet service providers to look up website addresses for users, contains a flaw in how it validates certain DNS zone data. If configured to use ZONEMD validation, the software may incorrectly accept invalid or tampered DNS records. This could allow an attacker to provide incorrect network information to the system, potentially leading to users being directed to the wrong destinations.
Technical details
An improper input validation vulnerability (CWE-20) exists in PowerDNS Recursor's ZONEMD validation logic within the 'zonemd.cc' component. When the 'ZoneToCache' feature is configured with ZONEMD validation enabled, the recursor may fail to reject zones that do not meet the required cryptographic or structural integrity checks. A remote attacker could potentially exploit this to inject invalid zone data into the recursor's cache. The vulnerability affects version 5.4.0 and is fixed in version 5.4.3. Exploitation requires the specific 'ZoneToCache' configuration to be active.
Affected products
- PowerDNS Recursor 5.4.0 to 5.4.2
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory