CVE-2026-42002

Concurrency and locking defects in GSS-TSIG

5.9 MediumFix available

CVE-2026-42002 is a medium vulnerability (CVSS 5.9) in Powerdns Authoritative, published May 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in pdns 5.0.5-r0.

Concurrency and locking defects in GSS-TSIG

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.26%Up 0.2 points since May 21, 2026

What each source reports

CVE List Score used 5.9

Concurrency and locking defects in GSS-TSIG

Concurrency and locking defects in GSS-TSIG

Record: CVE-2026-42002
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-364
Updated: 2026-11-02

EUVDEUVD-2026-31260 5.9

Concurrency and locking defects in GSS-TSIG

Record: EUVD-2026-31260
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vx6m-m9qv-88q3 5.9

Concurrency and locking defects in GSS-TSIG

Concurrency and locking defects in GSS-TSIG

Record: GHSA-vx6m-m9qv-88q3
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-364
Updated: 2026-11-02

NVD 5.9

Concurrency and locking defects in GSS-TSIG

Record: CVE-2026-42002
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-364
Updated: 2026-11-02

OSVALPINE-CVE-2026-42002 7.5

Concurrency and locking defects in GSS-TSIG

Record: ALPINE-CVE-2026-42002
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSV 5.9

Concurrency and locking defects in GSS-TSIG

Concurrency and locking defects in GSS-TSIG

Record: CVE-2026-42002
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-42002 7.5

Concurrency and locking defects in GSS-TSIG

Record: DEBIAN-CVE-2026-42002
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-42002 5.9

Concurrency and locking defects in GSS-TSIG

Record: UBUNTU-CVE-2026-42002
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

powerdns authoritative

Affected packages

Affected packages
Package	Affected	Fixed
`pdns` Alpine:v3.23	before 5.0.5-r0	5.0.5-r0
`pdns` Alpine:v3.24	before 5.0.5-r0	5.0.5-r0
`pdns` Debian:12	All versions, plus listed versions 4.7.3-24.8.0-14.8.0-24.8.1-14.8.1-2 Show 36 moreShow less 4.8.2-14.8.2-24.8.3-14.8.3-24.8.3-34.8.3-44.9.0-14.9.0-24.9.1-14.9.1-24.9.1-34.9.2-14.9.2-24.9.3-14.9.3-24.9.3-34.9.4-14.9.4-24.9.7-15.0.0-15.0.0-25.0.1-15.0.2-15.0.3-15.0.4-15.0.5-15.0.5-25.0.5-35.0.5-45.1.0-15.1.1-15.1.1-25.1.1-35.1.2-15.1.3-15.1.4-1	None known
`pdns` Debian:13	before 4.9.15-0+deb13u1, plus listed versions 4.9.14-0+deb13u14.9.7-1	4.9.15-0+deb13u1
`pdns` Debian:14	before 5.0.5-1, plus listed versions 4.9.7-15.0.0-15.0.0-25.0.1-15.0.2-15.0.3-15.0.4-1	5.0.5-1
`pdns` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.4.5-1build23.4.6-23.4.6-33.4.7-13.4.7-2 Show 5 moreShow less 4.0.0~alpha1-14.0.0~alpha2-24.0.0~alpha2-34.0.0~alpha2-3build14.0.0~alpha2-3ubuntu0.1~esm1	None known
`pdns` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 4.0.4-24.0.4-2build14.0.5-14.1.0-14.1.0-24.1.0-2build14.1.1-14.1.1-1ubuntu0.1~esm1	None known
`pdns` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 4.1.6-3build14.2.0-14.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1	None known
`pdns` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 4.4.1-1build14.4.1-34.4.1-44.5.2-1build14.5.3-14.5.3-1ubuntu0.1~esm1	None known
`pdns` Ubuntu:24.04:LTS	All versions, plus listed versions 4.8.1-1build14.8.3-24.8.3-2build14.8.3-34.8.3-44.8.3-4build24.8.3-4build3	None known
`pdns` Ubuntu:25.10	All versions, plus listed versions 4.9.4-24.9.7-14.9.7-1build25.0.0-2	None known
`pdns` Ubuntu:26.10	All versions, plus listed versions 5.0.2-1build15.0.5-45.1.0-15.1.1-15.1.1-2 Show 4 moreShow less 5.1.1-35.1.2-15.1.3-15.1.4-1	None known
`pdns` Ubuntu:26.04:LTS	All versions, plus listed versions 5.0.0-25.0.1-15.0.2-15.0.2-1build1	None known

History

History
When	Changed	Sources
2026-11-03	affected, aliases, references	OSV
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less