CVE-2026-42004

LowCVSS 3.7/10Last modified Oct 25, 2026

Description

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-115

Affected software

Vendor	Product	Versions
PowerDNS	DNSdist	>= 1.9.0, < 1.9.15; >= 2.0.0, < 2.0.7

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html

Timeline

Published: Jun 25, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-420054.3An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The CVE-2026-420064.3An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking on CVE-2026-420079.1An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing CVE-2026-420084.3Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a va CVE-2026-420097.5A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic CVE-2026-42017.3A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function U CVE-2026-420109.8A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing CVE-2026-420117.4A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate CVE-2026-420127.1A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains U CVE-2026-420138.2A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to CVE-2026-420146.6A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-CVE-2026-420155.3A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker