CVE-2026-52688 PUBLISHED

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

Assigner: OX
Reserved: 08.06.2026 Published: 23.07.2026 Updated: 23.07.2026

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 7.5

Product Status

Vendor PowerDNS
Product Recursor
Versions Default: unaffected
  • affected from 5.2.0 to 5.2.12 (excl.)
  • affected from 5.3.0 to 5.3.9 (excl.)
  • affected from 5.4.0 to 5.4.4 (excl.)

Credits

  • Qifan Zhang from Palo Alto Networks finder

References

Problem Types

  • Insufficient Verification of Data Authenticity CWE