vulnwire
7.5high

CVE-2026-52688

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

Published 3 mo ago · modified 15 d ago · JSON

CVSS
7.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 7%
Public exploits
0
none known

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction (EPSS)

0.18% probability of exploitation in the next 30 days, higher than 7% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

  • PowerDNS Recursor

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity
  • CWE-295 Improper Certificate Validation

References

  • docs.powerdns.com /recursor/security-advisories/powerdns-advisory-powerdns-2026-10.html

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.