CVE-2026-40012
Information about ECS zero scoped answers might leak to clients that use a specific ECS
CVE-2026-40012 is a medium vulnerability (CVSS 5.3) in Powerdns Recursor, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in pdns-recursor 5.4.3-r0.
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Information about ECS zero scoped answers might leak to clients that use a specific ECS
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
- Record
CVE-2026-40012- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-02
EUVDEUVD-2026-39356
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
- Record
EUVD-2026-39356- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fmvv-f47m-6c7p
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only...
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
- Record
GHSA-fmvv-f47m-6c7p- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-02
NVD
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
- Record
CVE-2026-40012- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-524
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-40012
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
- Record
ALPINE-CVE-2026-40012- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
OSV
Information about ECS zero scoped answers might leak to clients that use a specific ECS
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
- Record
CVE-2026-40012- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-40012
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
- Record
DEBIAN-CVE-2026-40012- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-40012
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
- Record
UBUNTU-CVE-2026-40012- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorAlpine:v3.24 |
before 5.4.3-r0 | 5.4.3-r0 |
pdns-recursorDebian:12 |
All versions, plus listed versions 4.8.4-14.8.6-14.8.7-14.8.8-14.8.8-1+deb12u1 Show 45 moreShow less4.9.0-14.9.0-24.9.1-14.9.1-24.9.1-34.9.1-44.9.2-14.9.2-24.9.3-14.9.4-14.9.5-15.0.5-15.0.7-15.0.7-25.0.9-15.1.3-15.1.3-25.2.0-15.2.0-25.2.0-35.2.0-45.2.0-55.2.1-15.2.2-15.2.2-25.2.4-15.2.4-25.2.5-15.3.0-15.3.0-25.3.0-35.3.0-45.3.0-55.3.1-15.3.3-15.3.4-15.3.4-25.3.5-15.4.0-15.4.1-15.4.1-25.4.2-15.4.2-25.4.3-15.4.4-1 |
None known |
pdns-recursorDebian:13 |
before 5.2.11-0+deb13u1, plus listed versions 5.2.4-25.2.4-2+deb13u15.2.5-15.2.6-0+deb13u15.2.7-0+deb13u15.2.8-0+deb13u15.2.9-0+deb13u1 |
5.2.11-0+deb13u1 |
pdns-recursorDebian:14 |
before 5.4.3-1, plus listed versions 5.2.4-25.2.5-15.3.0-15.3.0-25.3.0-3 Show 12 moreShow less5.3.0-45.3.0-55.3.1-15.3.3-15.3.4-15.3.4-25.3.5-15.4.0-15.4.1-15.4.1-25.4.2-15.4.2-2 |
5.4.3-1 |
pdns-recursorUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1 |
None known |
pdns-recursorUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1 |
None known |
pdns-recursorUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1 |
None known |
pdns-recursorUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 4.4.2-34.6.0-1ubuntu14.6.0-1ubuntu1+esm1 |
None known |
pdns-recursorUbuntu:24.04:LTS |
All versions, plus listed versions 4.9.0-24.9.1-44.9.2-14.9.2-1build14.9.2-24.9.3-14.9.3-1build24.9.3-1build3 |
None known |
pdns-recursorUbuntu:25.10 |
All versions, plus listed versions 5.2.0-55.2.2-15.2.2-25.2.4-25.2.4-2build2 |
None known |
pdns-recursorUbuntu:26.10 |
All versions, plus listed versions 5.3.5-15.4.3-15.4.5-1 |
None known |
pdns-recursorUbuntu:26.04:LTS |
All versions, plus listed versions 5.2.4-2build25.3.1-15.3.3-15.3.4-15.3.4-1build15.3.4-25.3.5-1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected, aliases, references | OSV |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-08.html
nvd.nist.gov/vuln/detail/CVE-2026-40012
github.com/advisories/GHSA-fmvv-f47m-6c7p
security.alpinelinux.org/vuln/CVE-2026-40012
repo.powerdns.com
Left out here: 4 versions. The JSON record has them.