CVE-2026-52686
- Source
- https://cve.org/CVERecord?id=CVE-2026-52686
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52686.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-52686
- Downstream
- Published
- 2026-07-23T08:03:37.563Z
- Modified
- 2026-08-12T16:09:43.726251Z
- Severity
-
- 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- Wildcard CNAME proof validation bypass
- Details
-
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
- Database specific
{ "cna_assigner": "OX", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52686.json" }- References
Affected packages
Git / github.com/powerdns/pdns
Affected versions
rec-5.*
rec-5.2.0
rec-5.2.10
rec-5.2.2
rec-5.2.4
rec-5.2.5
rec-5.2.6
rec-5.2.8
rec-5.3.0
rec-5.3.1
rec-5.3.4
rec-5.3.7
rec-5.4.0
rec-5.4.0-rc1
rec-5.4.2
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52686.json"
vanir_signatures
[
{
"target": {
"file": "pdns/recursordist/test-syncres_cc5.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/53dfd1af948d1ff716bfd7615c99d442f984f2af",
"id": "CVE-2026-52686-2c1afdfc",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178873075834533611826354203572646335453",
"68263735809913871838746811403036930818",
"294444694510304319079283491520384127394"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "BOOST_AUTO_TEST_CASE",
"file": "pdns/recursordist/test-syncres_cc3.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/64c4f00f2b3d4d4153837e0dac7979108bb7749d",
"id": "CVE-2026-52686-35f327f4",
"signature_version": "v1",
"digest": {
"length": 2403.0,
"function_hash": "321149023720598022539412040809182724434"
},
"signature_type": "Function"
},
{
"target": {
"file": "pdns/recursordist/test-syncres_cc5.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/64c4f00f2b3d4d4153837e0dac7979108bb7749d",
"id": "CVE-2026-52686-6bcd6862",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178873075834533611826354203572646335453",
"68263735809913871838746811403036930818",
"294444694510304319079283491520384127394"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "BOOST_AUTO_TEST_CASE",
"file": "pdns/recursordist/test-syncres_cc3.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/53dfd1af948d1ff716bfd7615c99d442f984f2af",
"id": "CVE-2026-52686-6cae02a6",
"signature_version": "v1",
"digest": {
"length": 2428.0,
"function_hash": "258267957240144922330224967661450450682"
},
"signature_type": "Function"
},
{
"target": {
"file": "pdns/recursordist/test-syncres_cc3.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/b74225ba558d1f9f91afea21e2496e959b13a869",
"id": "CVE-2026-52686-76011dd0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"106569573838865247464307234769346066715",
"337150974165016024551258499133453014952",
"218481867416778457803486745456845507383",
"157655217356913886569894448030175024547",
"248156571117347467765796622478284936084",
"307887380809890849389531454689952325347",
"51702223358558618912832015651184195290",
"235554931327345047041575667554445165376",
"162428951744519780812352849584821019985",
"17249239844122454052214489940024267068",
"60231686453930854969393532231747360909",
"95462097068831580277633752685695755496",
"326352126669537614206569303915384356609",
"73703024515535674936544244867854127173",
"60231686453930854969393532231747360909",
"178697427454676480772870741543305747383",
"165597800729126234550816218361303845739",
"100596704174744233326561554363384125365"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "pdns/recursordist/test-syncres_cc3.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/64c4f00f2b3d4d4153837e0dac7979108bb7749d",
"id": "CVE-2026-52686-7834f556",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"33603439876409110263785087511525218320",
"74654839639281459608232486504707582691",
"225285901495535655876286067276264882660",
"248923153194528543087168242480905926413",
"108216919319730988085055095374831063971",
"14178690043366037878039177241800927421",
"156664093802573320955398940033836976928",
"278488168796688839512857130039481466315",
"162428951744519780812352849584821019985",
"17249239844122454052214489940024267068",
"60231686453930854969393532231747360909",
"95462097068831580277633752685695755496",
"326352126669537614206569303915384356609",
"73703024515535674936544244867854127173",
"138739682639390937155709743969849660680",
"97715549145799718766007427639761870407",
"165597800729126234550816218361303845739",
"100596704174744233326561554363384125365"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "BOOST_AUTO_TEST_CASE",
"file": "pdns/recursordist/test-syncres_cc3.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/b74225ba558d1f9f91afea21e2496e959b13a869",
"id": "CVE-2026-52686-8a5aaf54",
"signature_version": "v1",
"digest": {
"length": 2364.0,
"function_hash": "11311640072020377701413772862222554475"
},
"signature_type": "Function"
},
{
"target": {
"file": "pdns/recursordist/test-syncres_cc3.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/53dfd1af948d1ff716bfd7615c99d442f984f2af",
"id": "CVE-2026-52686-90cf4f85",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"106569573838865247464307234769346066715",
"337150974165016024551258499133453014952",
"218481867416778457803486745456845507383",
"157655217356913886569894448030175024547",
"248156571117347467765796622478284936084",
"307887380809890849389531454689952325347",
"51702223358558618912832015651184195290",
"235554931327345047041575667554445165376",
"162428951744519780812352849584821019985",
"17249239844122454052214489940024267068",
"60231686453930854969393532231747360909",
"95462097068831580277633752685695755496",
"326352126669537614206569303915384356609",
"73703024515535674936544244867854127173",
"138739682639390937155709743969849660680",
"97715549145799718766007427639761870407",
"165597800729126234550816218361303845739",
"100596704174744233326561554363384125365"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "pdns/recursordist/syncres.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/b74225ba558d1f9f91afea21e2496e959b13a869",
"id": "CVE-2026-52686-9eed3a94",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"61123529858778556868434676469700833829",
"172192151217593938007461763699673554038",
"334031098597955816637463931250824513620",
"144092927544696201842525231323248028675",
"125364601277516619271008056276759613510",
"292339451060319529698601410068244870621",
"145368734622526732459095691986870150285",
"257641602359282688585110366670451835248",
"82276684157634677172891987079910472135",
"279568230016434762686300005486808232594",
"228454478493326969791383891315097681212",
"272307584847886740173261091502078231186",
"151186040936910880353869104747765600782",
"96634521900868265660556810104791666290",
"111690656414816116449727870568960866890",
"224175059376717234293934551562625711747",
"93205899823498420593240065338014104031",
"176113646396417689675597576401323210911",
"233368381172057152469052240950631651518",
"147228350144465925776158818059329616532",
"294171572668465934090004360442390250078",
"172971984414156566578013168285329558882",
"76518826411347545341447968654201528111",
"287036674253239750820707615364040372431",
"206417983724872551403588071857369601531",
"190301942541846331735240089066313943299",
"154757172545440668849437570984911071",
"100297734200759198975563110441824994088",
"84340766976620446047067835708138334576",
"269935357300254612252527048833911171658",
"93748529309838173492175295853710082554",
"129424820874993847529116070963047870901",
"99288272290264190256935684522887741369",
"196170717154135016223665361339421510706",
"180123053493720674990987942453243609849",
"281096763625437540190994747829376358479",
"123092499724207133284550188084850397192",
"156377717540603171085481970823325384007",
"105753165065393061097919375976739557309",
"139898771205710912304203928656518890553",
"275352633607350611309317444743551248874",
"88680560123909053252903416597268864817",
"190053403352906738263237380846642625514",
"339538497369717774285633659512474045841",
"161257042474926511671723190410639702492",
"90172337027019397345288351449721830269",
"16715741445812420456573926249797038729",
"205176771747096583481240612923586690353",
"152362791468733055665976935012550848976",
"44212538362987457055731350574196867911",
"181064023028173555713855454994317145990",
"337902410219924545282653803910599949821",
"257665780353633789054072576428447857312",
"266365902721351045421093662089433308526",
"293850398991963996058566640103429580857",
"317084925581858491889818480471675405972",
"328409990110020075899118305897980857514",
"32243119026549283233982570865308124256",
"37370521536392696182337227700701599394",
"164206158968753388913360339446085506837",
"20735636875069941819492467197481235384",
"259599458677180427318374307621606341632",
"12013551146669531838324780270564938596",
"294341267680978015218234067028470766256",
"146455459366941789385095040293914786464",
"10852551676209040866051156497043311505",
"147147281490762037630302429287068124692",
"73707210910882516307796677160556051752",
"15205899426777232943331497851876553098",
"31324263582972619781281825666767614241",
"68680874598283766253091873972817936207"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "pdns/recursordist/syncres.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/64c4f00f2b3d4d4153837e0dac7979108bb7749d",
"id": "CVE-2026-52686-a5078232",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"297690379756825001883693258821284086787",
"275190756499235142776542164331574414796",
"304084711605878169466962246458596650124",
"130405718195737931270165725987888592811",
"125364601277516619271008056276759613510",
"292339451060319529698601410068244870621",
"145368734622526732459095691986870150285",
"257641602359282688585110366670451835248",
"82276684157634677172891987079910472135",
"279568230016434762686300005486808232594",
"228454478493326969791383891315097681212",
"272307584847886740173261091502078231186",
"151186040936910880353869104747765600782",
"96634521900868265660556810104791666290",
"111690656414816116449727870568960866890",
"224175059376717234293934551562625711747",
"93205899823498420593240065338014104031",
"176113646396417689675597576401323210911",
"233368381172057152469052240950631651518",
"147228350144465925776158818059329616532",
"294171572668465934090004360442390250078",
"172971984414156566578013168285329558882",
"76518826411347545341447968654201528111",
"287036674253239750820707615364040372431",
"206417983724872551403588071857369601531",
"190301942541846331735240089066313943299",
"154757172545440668849437570984911071",
"100297734200759198975563110441824994088",
"84340766976620446047067835708138334576",
"269935357300254612252527048833911171658",
"93748529309838173492175295853710082554",
"129424820874993847529116070963047870901",
"99288272290264190256935684522887741369",
"196170717154135016223665361339421510706",
"180123053493720674990987942453243609849",
"281096763625437540190994747829376358479",
"123092499724207133284550188084850397192",
"156377717540603171085481970823325384007",
"105753165065393061097919375976739557309",
"139898771205710912304203928656518890553",
"275352633607350611309317444743551248874",
"88680560123909053252903416597268864817",
"190053403352906738263237380846642625514",
"339538497369717774285633659512474045841",
"161257042474926511671723190410639702492",
"90172337027019397345288351449721830269",
"16715741445812420456573926249797038729",
"205176771747096583481240612923586690353",
"152362791468733055665976935012550848976",
"44212538362987457055731350574196867911",
"181064023028173555713855454994317145990",
"337902410219924545282653803910599949821",
"91667585988537952207731139706057645229",
"217197231109440792318246243204396185769",
"80395414593882684026713423127433193161",
"295965049720416209755283966195102050788",
"328409990110020075899118305897980857514",
"32243119026549283233982570865308124256",
"37370521536392696182337227700701599394",
"164206158968753388913360339446085506837",
"20735636875069941819492467197481235384",
"259599458677180427318374307621606341632",
"12013551146669531838324780270564938596",
"294341267680978015218234067028470766256",
"263263348386876433864499375321388411471",
"323720804791957688069070547868983161033",
"305744094165594011479926833270667333557",
"278790883106659125148446118266362472579",
"15205899426777232943331497851876553098",
"31324263582972619781281825666767614241",
"68680874598283766253091873972817936207"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "SyncRes::updateCacheFromRecords",
"file": "pdns/recursordist/syncres.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/64c4f00f2b3d4d4153837e0dac7979108bb7749d",
"id": "CVE-2026-52686-afb28141",
"signature_version": "v1",
"digest": {
"length": 12512.0,
"function_hash": "65181445179713969558439273207228894381"
},
"signature_type": "Function"
},
{
"target": {
"function": "SyncRes::updateCacheFromRecords",
"file": "pdns/recursordist/syncres.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/b74225ba558d1f9f91afea21e2496e959b13a869",
"id": "CVE-2026-52686-c8900862",
"signature_version": "v1",
"digest": {
"length": 12552.0,
"function_hash": "133502965729763685348340429062301544949"
},
"signature_type": "Function"
},
{
"target": {
"file": "pdns/recursordist/test-syncres_cc5.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/b74225ba558d1f9f91afea21e2496e959b13a869",
"id": "CVE-2026-52686-d2f627b9",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178873075834533611826354203572646335453",
"68263735809913871838746811403036930818",
"294444694510304319079283491520384127394"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "SyncRes::updateCacheFromRecords",
"file": "pdns/recursordist/syncres.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/53dfd1af948d1ff716bfd7615c99d442f984f2af",
"id": "CVE-2026-52686-e2cd8507",
"signature_version": "v1",
"digest": {
"length": 12398.0,
"function_hash": "236375304593854131153234969050137430138"
},
"signature_type": "Function"
},
{
"target": {
"file": "pdns/recursordist/syncres.cc"
},
"deprecated": false,
"source": "https://github.com/powerdns/pdns/commit/53dfd1af948d1ff716bfd7615c99d442f984f2af",
"id": "CVE-2026-52686-fcb81cb8",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"297690379756825001883693258821284086787",
"275190756499235142776542164331574414796",
"304084711605878169466962246458596650124",
"130405718195737931270165725987888592811",
"125364601277516619271008056276759613510",
"292339451060319529698601410068244870621",
"145368734622526732459095691986870150285",
"257641602359282688585110366670451835248",
"82276684157634677172891987079910472135",
"279568230016434762686300005486808232594",
"228454478493326969791383891315097681212",
"272307584847886740173261091502078231186",
"151186040936910880353869104747765600782",
"96634521900868265660556810104791666290",
"111690656414816116449727870568960866890",
"224175059376717234293934551562625711747",
"93205899823498420593240065338014104031",
"176113646396417689675597576401323210911",
"233368381172057152469052240950631651518",
"147228350144465925776158818059329616532",
"294171572668465934090004360442390250078",
"172971984414156566578013168285329558882",
"76518826411347545341447968654201528111",
"287036674253239750820707615364040372431",
"206417983724872551403588071857369601531",
"190301942541846331735240089066313943299",
"154757172545440668849437570984911071",
"100297734200759198975563110441824994088",
"84340766976620446047067835708138334576",
"269935357300254612252527048833911171658",
"93748529309838173492175295853710082554",
"129424820874993847529116070963047870901",
"99288272290264190256935684522887741369",
"196170717154135016223665361339421510706",
"180123053493720674990987942453243609849",
"281096763625437540190994747829376358479",
"123092499724207133284550188084850397192",
"156377717540603171085481970823325384007",
"105753165065393061097919375976739557309",
"139898771205710912304203928656518890553",
"275352633607350611309317444743551248874",
"88680560123909053252903416597268864817",
"190053403352906738263237380846642625514",
"339538497369717774285633659512474045841",
"161257042474926511671723190410639702492",
"90172337027019397345288351449721830269",
"16715741445812420456573926249797038729",
"205176771747096583481240612923586690353",
"152362791468733055665976935012550848976",
"44212538362987457055731350574196867911",
"181064023028173555713855454994317145990",
"337902410219924545282653803910599949821",
"108547899878426062504983998997034478399",
"248620222534135867042372373798025371446",
"333350224959081254437720271202562991339",
"106461829793279816888332070833781027351",
"328409990110020075899118305897980857514",
"32243119026549283233982570865308124256",
"37370521536392696182337227700701599394",
"164206158968753388913360339446085506837",
"20735636875069941819492467197481235384",
"259599458677180427318374307621606341632",
"12013551146669531838324780270564938596",
"294341267680978015218234067028470766256",
"146455459366941789385095040293914786464",
"10852551676209040866051156497043311505",
"147147281490762037630302429287068124692",
"73707210910882516307796677160556051752",
"15205899426777232943331497851876553098",
"31324263582972619781281825666767614241",
"68680874598283766253091873972817936207"
]
},
"signature_type": "Line"
}
]
vanir_signatures_modified
"2026-08-12T16:09:43Z"