CVE-2026-52684

LowCVSS 3.7/10Last modified Oct 24, 2026

Description

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 23, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-526863.7The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when CVE-2026-526876.5An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large CVE-2026-526887.5RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation CVE-2026-52699.8In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software CVE-2026-526905.9Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served CVE-2026-526918.8** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache CVE-2026-526927.5Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.CVE-2026-526939.3Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.CVE-2026-526947.5Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.CVE-2026-526957.5Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.CVE-2026-526967.5Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.CVE-2026-526978.5Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.