p PatchFirst

CVE-2026-42390

CVE-2026-42390 · ZONEMD validation can be bypassed

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • recursor

    Versions
    • ≥ 5.4.0, < 5.4.3: Affected (semver)

    Update to 5.4.3

  • pdns-recursor Debian:12

    Versions
    • 4.8.4-1
    • 4.8.6-1
    • 4.8.7-1
    • 4.8.8-1
    • 4.8.8-1+deb12u1
    • 4.9.0-1
    • 4.9.0-2
    • 4.9.1-1
    • 4.9.1-2
    • 4.9.1-3
    • 4.9.1-4
    • 4.9.2-1
    • 4.9.2-2
    • 4.9.3-1
    • 4.9.4-1
    • 4.9.5-1
    • 5.0.5-1
    • 5.0.7-1
    • 5.0.7-2
    • 5.0.9-1
    • 5.1.3-1
    • 5.1.3-2
    • 5.2.0-1
    • 5.2.0-2
    • 5.2.0-3
    • 5.2.0-4
    • 5.2.0-5
    • 5.2.1-1
    • 5.2.2-1
    • 5.2.2-2
    • 5.2.4-1
    • 5.2.4-2
    • 5.2.5-1
    • 5.3.0-1
    • 5.3.0-2
    • 5.3.0-3
    • 5.3.0-4
    • 5.3.0-5
    • 5.3.1-1
    • 5.3.3-1
    • 5.3.4-1
    • 5.3.4-2
    • 5.3.5-1
    • 5.4.0-1
    • 5.4.1-1
    • 5.4.1-2
    • 5.4.2-1
    • 5.4.2-2
    • 5.4.3-1
    • 5.4.4-1
    • 5.4.5-1
    • 5.4.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Debian:13

    Versions
    • 5.2.4-2
    • 5.2.4-2+deb13u1
    • 5.2.5-1
    • 5.2.6-0+deb13u1
    • 5.2.7-0+deb13u1
    • 5.2.8-0+deb13u1
    • 5.2.9-0+deb13u1
    Affected ranges
    • ECOSYSTEM: < 5.2.11-0+deb13u1

    Update to 5.2.11-0+deb13u1

  • pdns-recursor Debian:14

    Versions
    • 5.2.4-2
    • 5.2.5-1
    • 5.3.0-1
    • 5.3.0-2
    • 5.3.0-3
    • 5.3.0-4
    • 5.3.0-5
    • 5.3.1-1
    • 5.3.3-1
    • 5.3.4-1
    • 5.3.4-2
    • 5.3.5-1
    • 5.4.0-1
    • 5.4.1-1
    • 5.4.1-2
    • 5.4.2-1
    • 5.4.2-2
    Affected ranges
    • ECOSYSTEM: < 5.4.3-1

    Update to 5.4.3-1

  • pdns-recursor Ubuntu:Pro:16.04:LTS

    Versions
    • 3.7.3-1
    • 4.0.0~alpha1-1
    • 4.0.0~alpha1-2
    • 4.0.0~alpha2-2
    • 4.0.0~alpha2-2ubuntu0.1
    • 4.0.0~alpha2-2ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:Pro:18.04:LTS

    Versions
    • 4.0.6-1
    • 4.0.6-1build1
    • 4.0.7-1
    • 4.1.1-1
    • 4.1.1-1build1
    • 4.1.1-2
    • 4.1.1-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:Pro:20.04:LTS

    Versions
    • 4.2.0-6
    • 4.2.1-1
    • 4.2.1-1build1
    • 4.2.1-1build2
    • 4.2.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:Pro:22.04:LTS

    Versions
    • 4.4.2-3
    • 4.6.0-1ubuntu1
    • 4.6.0-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:24.04:LTS

    Versions
    • 4.9.0-2
    • 4.9.1-4
    • 4.9.2-1
    • 4.9.2-1build1
    • 4.9.2-2
    • 4.9.3-1
    • 4.9.3-1build2
    • 4.9.3-1build3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:25.10

    Versions
    • 5.2.0-5
    • 5.2.2-1
    • 5.2.2-2
    • 5.2.4-2
    • 5.2.4-2build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:26.10

    Versions
    • 5.3.5-1
    • 5.4.3-1
    • 5.4.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdns-recursor Ubuntu:26.04:LTS

    Versions
    • 5.2.4-2build2
    • 5.3.1-1
    • 5.3.3-1
    • 5.3.4-1
    • 5.3.4-1build1
    • 5.3.4-2
    • 5.3.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →