CVE-2026-42390

MediumCVSS 5.3/10Last modified Jun 25, 2026

Description

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Jun 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-423917.5An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPCVE-2026-423924.3An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the erCVE-2026-423933.1The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attCVE-2026-423954.3A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following logCVE-2026-423966.5Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to FailCVE-2026-423976.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130CVE-2026-423987.7Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-confiCVE-2026-423996.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated lCVE-2026-42407.5A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_sCVE-2026-424006.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated uCVE-2026-424015.4Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access tCVE-2026-424027.5Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Polic
CVE-2026-42390: Medium severity, CVSS 5.3 | Vulnix