DNSSEC Wildcard Validation Bypass in PowerDNS Recursor
CVE-2026-52688

7.5HIGH

Key Information:

Vendor

Powerdns

Status
Recursor
Vendor
CVE Published:
23 July 2026

What is CVE-2026-52688?

A vulnerability in PowerDNS Recursor allows for the bypass of DNSSEC wildcard validation due to improper handling of RRSIGs with insufficient labels. This can potentially lead to security vulnerabilities where attackers could exploit the bypass to return malicious or misleading DNS responses. Administrators are advised to review their configurations and apply the necessary security patches.

Affected Version(s)

Recursor 5.2.0 < 5.2.12

Recursor 5.3.0 < 5.3.9

Recursor 5.4.0 < 5.4.4

References

https://docs.powerdns.com/recursor/security-advisories/po...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qifan Zhang from Palo Alto Networks
.