Vulnerability · Published Jul 23, 2026 · Assigned by OX
CVE-2026-52684Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack
Low 3.7
In plain English
A low-severity security flaw in Recursor from PowerDNS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.2%top 86.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pdns-recursor | no fix listed | DEBIAN-CVE-2026-52684 |
| Debian:13 | pdns-recursor | no fix listed | DEBIAN-CVE-2026-52684 |
| Debian:14 | pdns-recursor | no fix listed | DEBIAN-CVE-2026-52684 |
| Ubuntu:24.04:LTS | pdns-recursor | no fix listed | UBUNTU-CVE-2026-52684 |
| Ubuntu:26.04:LTS | pdns-recursor | no fix listed | UBUNTU-CVE-2026-52684 |
| Ubuntu:26.10 | pdns-recursor | no fix listed | UBUNTU-CVE-2026-52684 |