# CVE-2026-52684: PowerDNS Recursor TTL capping bypass in NS record refresh

Source: https://junglewise.ai/threats/cve-2026-52684-powerdns-recursor-ttl-capping-bypass-in-ns-record-refresh  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-52684 · Severity: low · CVSS 3.7 · Published 2026-07-23

PowerDNS Recursor, a tool used by internet service providers to look up website addresses, contains a minor flaw in how it handles expiring records. Under specific conditions involving very slow network responses, the system may fail to properly limit the 'Time to Live' (TTL) for certain internal records. This could lead to records staying in the system's memory longer than intended, though it does not pose a significant risk to data security or service availability.

Technologies: [Powerdns Recursor](https://junglewise.ai/threats/technologies/recursor). Vendors: [Powerdns](https://junglewise.ai/threats/vendors/powerdns).

## Quick answers

**Is CVE-2026-52684 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52684 being exploited in the wild.

**How severe is CVE-2026-52684?** Low severity, with a CVSS score of 3.7, published 23 July 2026.

**Which products and versions are affected?** Powerdns Recursor < 5.5.0.

**Is there a fix for CVE-2026-52684?** A patch was published on 2026-07-20: Pull request merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52684 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-52684?** Check whether you run Powerdns Recursor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in PowerDNS Recursor versions prior to 5.5.0 occurs within the 'refresh-almost-expired' logic. When the recursor attempts to refresh authoritative NS records that are nearing expiration, a race condition can occur if the authoritative server responds very slowly. If the records expire while the recursor is waiting for the response, the lack of valid data prevents the enforcement of TTL capping. This issue is specific to the background refresh mechanism and does not affect standard resolution paths. An attacker cannot easily trigger this, as it relies on specific timing and upstream latency. The issue is addressed in version 5.5.0 by disabling NS record refreshes in the 'refresh-almost-expired' component.

## Affected products

- PowerDNS Recursor < 5.5.0

## Timeline

- 2026-07-20: patched: Pull request merged into master branch
- 2026-07-23: disclosed: CVE published

## References

- [https://repo.powerdns.com/](https://repo.powerdns.com/)
- [https://github.com/PowerDNS/pdns/pull/17748](https://github.com/PowerDNS/pdns/pull/17748)

## Related threats

- [PowerDNS Recursor DNSSEC wildcard validation bypass in RRSIG processing](https://junglewise.ai/threats/cve-2026-52688-powerdns-recursor-dnssec-wildcard-validation-bypass-in-rrsig)
- [PowerDNS Recursor DNSSEC validation bypass in wildcard CNAME/DNAME records](https://junglewise.ai/threats/cve-2026-52686-powerdns-recursor-dnssec-validation-bypass-in-wildcard-cname)
- [PowerDNS Recursor DNSSEC validation failure via EDNS spoofing](https://junglewise.ai/threats/cve-2026-52690-powerdns-recursor-dnssec-validation-failure-via-edns-spoofing)
- [PowerDNS Recursor improper ZONEMD validation in ZoneToCache](https://junglewise.ai/threats/cve-2026-42390-powerdns-recursor-improper-zonemd-validation-in-zonetocache)
- [PowerDNS Recursor insufficient validation of authoritative answers](https://junglewise.ai/threats/cve-2026-42389-powerdns-recursor-insufficient-validation-of-authoritative)