Low severity3.7OSV Advisory· Published Jul 23, 2026· Updated Jul 23, 2026

CVE-2026-52686

Description

The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.

Affected products

PowerDNS/PdnsOSV
Range: rec-5.2.10, rec-5.3.7, rec-5.4.2, …
PowerDNS/Pdns Recursorllm-fuzzy

Patches

Vulnerability mechanics

References

docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerdns-2026-10.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.240
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000