PowerDNS DNSdist up to 1.9.14/2.0.6 EDNS interpretation input

Summaryinfo

A vulnerability classified as problematic has been found in PowerDNS DNSdist up to 1.9.14/2.0.6. The affected element is an unknown function of the component EDNS Handler. The manipulation leads to interpretation input. This vulnerability is documented as CVE-2026-42004. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in PowerDNS DNSdist up to 1.9.14/2.0.6. It has been rated as problematic. This issue affects some unknown processing of the component EDNS Handler. The manipulation with an unknown input leads to a interpretation input vulnerability. Using CWE to declare the problem leads to CWE-115. The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion. Impacted is integrity. The summary by CVE is:

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

The weakness was released by Vitaly Simonovich. The advisory is shared at dnsdist.org. The identification of this vulnerability is CVE-2026-42004 since 04/23/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.9.15 or 2.0.7 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-39351). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Domain Name Software

Vendor

• PowerDNS

Name

• DNSdist

Version

• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5
• 1.9.6
• 1.9.7
• 1.9.8
• 1.9.9
• 1.9.10
• 1.9.11
• 1.9.12
• 1.9.13
• 1.9.14
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion