CVE-2026-42387— Insufficient input validation in ZoneToCache
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-42387
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insufficient input validation in ZoneToCache
Source: NVD (National Vulnerability Database)
Vulnerability Description
A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
PowerDNS Recursor 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PowerDNS recursor是PowerDNS公司开源的一款域名系统递归解析器。 PowerDNS Recursor 5.2.0之前版本、5.3.0之前版本和5.4.0之前版本存在输入验证错误漏洞，该漏洞源于输入验证不足，可能导致恶意权威服务器通过ZoneToCache函数发送特制区域，从而造成崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-42387
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42387
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-42387 (1)
Same Patch Batch · PowerDNS · 2026-06-25 · 14 CVEs total
| CVE-2026-33612 | 7.5 HIGH | ZoneToCache can poison the cache |
| CVE-2026-42388 | 5.9 MEDIUM | Missing input validation for catalog zones |
| CVE-2026-52690 | 5.9 MEDIUM | Spoofed answers can mark an authoritative non-EDNS capable |
| CVE-2026-42390 | 5.3 MEDIUM | ZONEMD validation can be bypassed |
| CVE-2026-42389 | 5.3 MEDIUM | Reject more queries with invalid header values |
| CVE-2026-40209 | 5.3 MEDIUM | Denial of service via IXFR queries |
| CVE-2026-40211 | 5.3 MEDIUM | Denial of service via crafted DoH3 queries |
| CVE-2026-40012 | 5.3 MEDIUM | Information about ECS zero scoped answers might leak to clients that use a specific ECS |
| CVE-2026-40210 | 4.8 MEDIUM | Out-of-bounds read in SetMacAddrAction |
| CVE-2026-42005 | 4.3 MEDIUM | Insufficient input validation of internal web server |
| CVE-2026-42004 | 3.7 LOW | EDNS options smuggling |
| CVE-2026-40011 | 3.7 LOW | Prometheus denial of service via crafted DNS queries |
| CVE-2026-40208 | 3.7 LOW | Denial of service via DoH3 queries |
IV. Related Vulnerabilities
Same product: Recursor
- CVE-2026-42389
Reject more queries with invalid header values - CVE-2026-52690
Spoofed answers can mark an authoritative non-EDNS capable - CVE-2026-42390
ZONEMD validation can be bypassed - CVE-2026-42388
Missing input validation for catalog zones - CVE-2026-40012
Information about ECS zero scoped answers might leak to clie
Same vendor: PowerDNS
- CVE-2026-42389
Reject more queries with invalid header values - CVE-2026-52690
Spoofed answers can mark an authoritative non-EDNS capable - CVE-2026-42390
ZONEMD validation can be bypassed - CVE-2026-42388
Missing input validation for catalog zones - CVE-2026-40012
Information about ECS zero scoped answers might leak to clie
V. Comments for CVE-2026-42387
No comments yet