CVE-2026-42004 EDNS options smuggling
Attackers bypass DNSdist filtering rules by smuggling EDNS options via crafted records that are rewritten during ECS insertion, exposing backend systems to unfiltered data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42004?
CVE-2026-42004 is a low-severity vulnerability in PowerDNS DNSdist, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
Weakness: CWE-115
Which versions are affected by CVE-2026-42004?
How do I fix CVE-2026-42004?
Apply the vendor's patch.
Is CVE-2026-42004 being exploited?
There is no known exploitation of CVE-2026-42004 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-42004, GHSA-q4qq-c3qm-82jj, UBUNTU-CVE-2026-42004.