Executive brief
PowerDNS Recursor, a tool used by internet service providers to look up website addresses, contains a security flaw in how it verifies digital signatures for certain domain names. An attacker could exploit this to bypass security checks (DNSSEC), potentially allowing them to redirect users to malicious websites or provide false information. This could lead to users unknowingly visiting fraudulent sites or experiencing service disruptions.
Technical details
A vulnerability exists in the DNSSEC validation logic of PowerDNS Recursor, specifically within the 'validate.cc' component. The issue arises when processing RRSIG records that contain too few labels, which can lead to a bypass of wildcard validation. A remote, unauthenticated attacker can exploit this flaw by providing specially crafted DNS responses to a recursor performing validation. Successful exploitation allows the attacker to inject forged DNS data that should have been rejected by DNSSEC, compromising the integrity of name resolution. The vulnerability is addressed in versions 5.2.12, 5.3.9, and 5.4.4.
Affected products
- PowerDNS Recursor 5.2.0 to 5.2.11, 5.3.0 to 5.3.8, 5.4.0 to 5.4.3
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory