CVE-2026-52684 Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack
Attackers can poison the DNS cache by exploiting a TTL capping flaw in the prefetch feature, leading to persistent incorrect domain resolutions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-52684?
CVE-2026-52684 is a low-severity vulnerability in PowerDNS Recursor, published on 23 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records.
Which versions are affected by CVE-2026-52684?
How do I fix CVE-2026-52684?
No fix has been published for CVE-2026-52684 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-52684 being exploited?
There is no known exploitation of CVE-2026-52684 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-52684, GHSA-j58f-rgm2-v2p8, UBUNTU-CVE-2026-52684.