CVE-2026-52688
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
CVE-2026-52688 is a high vulnerability (CVSS 7.5) in Powerdns Recursor, published July 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in pdns-recursor 5.4.4-r0.
- Severity
- 7.5 HighCVSS 3.1, CVE List
- Exploit chance
- 0.18%EPSS, 7th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.4.4-r0pdns-recursor +11 more
Description
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorAlpine:v3.24 | before 5.4.4-r0 | 5.4.4-r0 |
pdns-recursorDebian:12 | All versions, plus listed versions 4.8.4-14.8.6-14.8.7-14.8.8-14.8.8-1+deb12u1 Show 45 moreShow less4.9.0-14.9.0-24.9.1-14.9.1-24.9.1-34.9.1-44.9.2-14.9.2-24.9.3-14.9.4-14.9.5-15.0.5-15.0.7-15.0.7-25.0.9-15.1.3-15.1.3-25.2.0-15.2.0-25.2.0-35.2.0-45.2.0-55.2.1-15.2.2-15.2.2-25.2.4-15.2.4-25.2.5-15.3.0-15.3.0-25.3.0-35.3.0-45.3.0-55.3.1-15.3.3-15.3.4-15.3.4-25.3.5-15.4.0-15.4.1-15.4.1-25.4.2-15.4.2-25.4.3-15.4.4-1 | None known |
pdns-recursorDebian:13 | before 5.2.12-0+deb13u1, plus listed versions 5.2.11-0+deb13u15.2.4-25.2.4-2+deb13u15.2.5-15.2.6-0+deb13u15.2.7-0+deb13u15.2.8-0+deb13u15.2.9-0+deb13u1 | 5.2.12-0+deb13u1 |
pdns-recursorDebian:14 | before 5.4.4-1, plus listed versions 5.2.4-25.2.5-15.3.0-15.3.0-25.3.0-3 Show 13 moreShow less5.3.0-45.3.0-55.3.1-15.3.3-15.3.4-15.3.4-25.3.5-15.4.0-15.4.1-15.4.1-25.4.2-15.4.2-25.4.3-1 | 5.4.4-1 |
pdns-recursorUbuntu:Pro:16.04:LTS | All versions, plus listed versions 3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1 | None known |
pdns-recursorUbuntu:Pro:18.04:LTS | All versions, plus listed versions 4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1 | None known |
pdns-recursorUbuntu:Pro:20.04:LTS | All versions, plus listed versions 4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1 | None known |
pdns-recursorUbuntu:Pro:22.04:LTS | All versions, plus listed versions 4.4.2-34.6.0-1ubuntu14.6.0-1ubuntu1+esm1 | None known |
pdns-recursorUbuntu:24.04:LTS | All versions, plus listed versions 4.9.0-24.9.1-44.9.2-14.9.2-1build14.9.2-24.9.3-14.9.3-1build24.9.3-1build3 | None known |
pdns-recursorUbuntu:26.10 | All versions, plus listed versions 5.3.5-15.4.3-15.4.5-1 | None known |
pdns-recursorUbuntu:26.04:LTS | All versions, plus listed versions 5.2.4-2build25.3.1-15.3.3-15.3.4-15.3.4-1build15.3.4-25.3.5-1 | None known |
pdns-recursoropenSUSE:Tumbleweed From an advisory covering 34 CVEs | before 5.4.8-1.1 | 5.4.8-1.1 |
What each source reports
CVE List Score used
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
- Record
CVE-2026-52688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-345, CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2026-47930
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
- Record
EUVD-2026-47930- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q3h2-8p56-9cg6
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
- Record
GHSA-q3h2-8p56-9cg6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
- Record
CVE-2026-52688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295, CWE-345
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-52688
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
- Record
ALPINE-CVE-2026-52688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSV
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
- Record
CVE-2026-52688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-12
OSVDEBIAN-CVE-2026-52688
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
- Record
DEBIAN-CVE-2026-52688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-52688
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
- Record
UBUNTU-CVE-2026-52688- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12532-1No score
pdns-recursor-5.4.8-1.1 on GA media
These are all security issues fixed in the pdns-recursor-5.4.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12532-1- Updated
- 2026-11-12
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html
nvd.nist.gov/vuln/detail/CVE-2026-52688
github.com/advisories/GHSA-q3h2-8p56-9cg6
security.alpinelinux.org/vuln/CVE-2026-52688
repo.powerdns.com
Show 39 moreShow less
security-tracker.debian.org/tracker/CVE-2026-52688
ubuntu.com/security/CVE-2026-52688
cve.org/CVERecord?id=CVE-2026-52688
doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html
suse.com/security/cve/CVE-2025-59023
Left out here: 4 versions. The JSON record has them.