CVE catalog

CVE-2026-85555

pdns-recursor affected and fixed versions

[CVE catalog]

[DNSSEC validation bypass and cache poisoning in PowerDNS Recursor via out-of-band NS resolution]

Severity
Medium
Published
Source
[NVD] · [CVE record]

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence
Original provider fields
{
  "package_releases": [
    {
      "name": "pdns-recursor",
      "status": "fixed",
      "release": "sid",
      "version": "5.4.9-1"
    },
    {
      "name": "pdns-recursor",
      "status": "fixed",
      "release": "forky",
      "version": "5.4.8-1"
    },
    {
      "name": "pdns-recursor",
      "status": "vulnerable",
      "release": "trixie",
      "version": "5.2.13-0+deb13u1"
    },
    {
      "name": "pdns-recursor",
      "status": "vulnerable",
      "release": "trixie-security",
      "version": "5.2.13-0+deb13u1"
    },
    {
      "name": "pdns-recursor",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "4.8.8-1+deb12u1"
    },
    {
      "name": "pdns-recursor",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "4.8.8-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "pdns-recursor",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5.4.8-1"
    },
    {
      "bug": null,
      "name": "pdns-recursor",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "5.4.8-1"
    },
    {
      "bug": null,
      "name": "pdns-recursor",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "pdns-recursor",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "pdns-recursor",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "4.4.2-3",
        "4.6.0-1ubuntu1",
        "4.6.0-1ubuntu1+esm1"
      ],
      "ecosystem": "deb",
      "fixed_version": "",
      "provider_record_id": "UBUNTU-CVE-2026-85555"
    },
    {
      "name": "pdns-recursor",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "4.9.0-2",
        "4.9.1-4",
        "4.9.2-1",
        "4.9.2-1build1",
        "4.9.2-2",
        "4.9.3-1",
        "4.9.3-1build2",
        "4.9.3-1build3"
      ],
      "ecosystem": "deb",
      "fixed_version": "",
      "provider_record_id": "UBUNTU-CVE-2026-85555"
    },
    {
      "name": "pdns-recursor",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.10",
      "versions": [
        "5.3.5-1",
        "5.4.3-1",
        "5.4.5-1"
      ],
      "ecosystem": "deb",
      "fixed_version": "",
      "provider_record_id": "UBUNTU-CVE-2026-85555"
    },
    {
      "name": "pdns-recursor",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "5.2.4-2build2",
        "5.3.1-1",
        "5.3.3-1",
        "5.3.4-1",
        "5.3.4-1build1",
        "5.3.4-2",
        "5.3.5-1"
      ],
      "ecosystem": "deb",
      "fixed_version": "",
      "provider_record_id": "UBUNTU-CVE-2026-85555"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [pdns-recursor]Unknown
    Details (4)

    • 4.8.8-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · pdns-recursor · debian · bookworm; dsa · pdns-recursor · debian · 12

    • 4.8.8-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · pdns-recursor · debian · bookworm; dsa · pdns-recursor · debian · 12

    • 4.8.8-1+deb12u1 · amd64 · bookworm-security

      Affected

      dsa · pdns-recursor · debian · bookworm; dsa · pdns-recursor · debian · 12

    • 4.8.8-1+deb12u1 · arm64 · bookworm-security

      Affected

      dsa · pdns-recursor · debian · bookworm; dsa · pdns-recursor · debian · 12

[Debian 13 (Trixie)]

  • [pdns-recursor]Unknown
    Details (4)

    • 5.2.11-0+deb13u1 · amd64 · trixie

      Affected

      dsa · pdns-recursor · debian · 13

    • 5.2.11-0+deb13u1 · arm64 · trixie

      Affected

      dsa · pdns-recursor · debian · 13

    • 5.2.13-0+deb13u1 · amd64 · trixie-security

      Affected

      dsa · pdns-recursor · debian · 13

    • 5.2.13-0+deb13u1 · arm64 · trixie-security

      Affected

      dsa · pdns-recursor · debian · 13

Observed:

References

[Debian Security Tracker] · [OSV Package Vulnerability Database]