Code Injection in PowerDNS Authoritative - CVE-2026-42396
Published: May 20, 2026
Vulnerability identifier: #VU131984
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42396
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to code injection in catalog zone label computation when processing an AXFR of a catalog zone with a member whose producer group option contains a double-quote character. A remote privileged user can provide catalog zone member data containing a double-quote character to cause a denial of service.
This issue causes the catalog zone transfer to fail.
Affected software
PowerDNS Authoritative
Debian Linux
Fedora
pdns (Debian package)
pdns
Debian Linux
Fedora
pdns (Debian package)
pdns
How to mitigate CVE-2026-42396
Install security update from vendor's website.
PowerDNS Authoritative - addressed in versions 4.9.15, 5.0.5
pdns (Debian package) - update to 4.9.15-0+deb13u1
pdns - addressed in versions 5.0.5-1.el9, 5.0.5-1.el10_2, 5.0.5-1.el10_3, 5.0.5-1.fc43, 5.0.5-1.fc44
pdns (Debian package) - update to 4.9.15-0+deb13u1
pdns - addressed in versions 5.0.5-1.el9, 5.0.5-1.el10_2, 5.0.5-1.el10_3, 5.0.5-1.fc43, 5.0.5-1.fc44