CVE-2026-42005

MediumCVSS 4.3/10Last modified Oct 25, 2026

Description

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
PowerDNSAuthoritative>= 4.9.0, < 4.9.16; >= 5.0.0, < 5.0.6; >= 5.1.0, < 5.1.2

References

Timeline

Published
Jun 25, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-420064.3An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking onCVE-2026-420079.1An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing CVE-2026-420084.3Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a vaCVE-2026-420097.5A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logicCVE-2026-42017.3A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function UCVE-2026-420109.8A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containingCVE-2026-420117.4A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate CVE-2026-420127.1A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains UCVE-2026-420138.2A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to CVE-2026-420146.6A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-CVE-2026-420155.3A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attackerCVE-2026-420168.8JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the to
CVE-2026-42005: Medium severity, CVSS 4.3 | Vulnix