CVE-2026-42004 EDNS options smuggling
LowCVSS 3.7
EPSS 0.22%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PowerDNS DNSdist | >= 1.9.0, < 1.9.15 | 1.9.15 |
| PowerDNS DNSdist | >= 2.0.0, < 2.0.7 | 2.0.7 |
| debian/dnsdist(Debian:12) | All versions | No fix listed |
| debian/dnsdist(Debian:12) | = 1.7.3-2 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.8.0-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.8.1-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.8.2-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.8.2-2 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.8.2-3 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.8.3-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.8.3-2 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.8.3-3 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.9.10-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.9.3-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.9.4-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.9.5-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.9.6-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.9.8-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 1.9.9-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.0-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.0-2 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.0-3 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.0-4 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.0-5 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.0-6 | No fix listed |
Show 43 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/dnsdist(Debian:12) | = 2.0.0~rc1-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.0~rc1-2 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.0~rc2-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.1-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.2-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.3-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.4-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.5-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.5-2 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.5-3 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.0.6-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.1.0-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.1.0-2 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.1.1-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.1.2-1 | No fix listed |
| debian/dnsdist(Debian:12) | = 2.1.3-1 | No fix listed |
| debian/dnsdist(Debian:13) | < 1.9.15-0+deb13u1 | 1.9.15-0+deb13u1 |
| debian/dnsdist(Debian:13) | = 1.9.10-1 | No fix listed |
| debian/dnsdist(Debian:13) | = 1.9.10-1+deb13u1 | No fix listed |
| debian/dnsdist(Debian:13) | = 1.9.14-0+deb13u1 | No fix listed |
| debian/dnsdist(Debian:14) | < 2.1.0-1 | 2.1.0-1 |
| debian/dnsdist(Debian:14) | = 1.9.10-1 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.0-1 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.0-2 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.0-3 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.0-4 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.0-5 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.0-6 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.0~rc1-1 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.0~rc1-2 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.0~rc2-1 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.1-1 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.2-1 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.3-1 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.4-1 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.5-1 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.5-2 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.5-3 | No fix listed |
| debian/dnsdist(Debian:14) | = 2.0.6-1 | No fix listed |
| ubuntu/dnsdist(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/dnsdist(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/dnsdist(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/dnsdist(Ubuntu:26.10) | All versions | No fix listed |
References
- www.dnsdist.org
- Debian Security Tracker CVE-2026-42004 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org