CVE-2026-42396 - Vulnerability Details - OpenCVE

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Powerdns	Authoritative

Configuration 1 [-]

OR	cpe:2.3:a:powerdns:authoritative::::::::
	cpe:2.3:a:powerdns:authoritative::::::::

No data.

References

Link	Providers
https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html

History

Tue, 26 May 2026 19:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:powerdns:authoritative::::::::

Thu, 21 May 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Thu, 21 May 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-94
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 21 May 2026 11:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Powerdns Powerdns authoritative
Weaknesses		CWE-20
Vendors & Products		Powerdns Powerdns authoritative

Thu, 21 May 2026 10:15:00 +0000

Type	Values Removed	Values Added
Description		Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail
Title		Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail
References		https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html
Metrics		cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: OX

Published: 2026-05-21T09:25:03.315Z

Updated: 2026-05-21T12:03:16.000Z

Reserved: 2026-04-27T08:53:58.839Z

Link: CVE-2026-42396

Vulnrichment

Updated: 2026-05-21T12:03:10.266Z

NVD

Status : Analyzed

Published: 2026-05-21T10:16:25.927

Modified: 2026-05-26T19:19:42.667

Link: CVE-2026-42396

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42396", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2026-04-27T08:53:58.839Z", "datePublished": "2026-05-21T09:25:03.315Z", "dateUpdated": "2026-05-21T12:03:16.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-05-21T09:25:03.315Z"}, "title": "Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail", "datePublic": "2026-05-19T22:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "affected": [{"vendor": "PowerDNS", "product": "Authoritative", "collectionURL": "https://repo.powerdns.com/", "packageName": "pdns", "repo": "https://github.com/PowerDNS/pdns", "modules": ["Catalog Zones"], "programFiles": ["auth-catalogzone.cc"], "versions": [{"status": "affected", "version": "4.9.0", "lessThan": "4.9.15", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail</p>"}]}], "references": [{"url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 4.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"}}], "credits": [{"lang": "en", "value": "ilhamaf", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-21T12:03:13.589644Z", "id": "CVE-2026-42396", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T12:03:16.000Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42396", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-21T12:03:13.589644Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T12:03:10.266Z"}}], "cna": {"title": "Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "ilhamaf"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/PowerDNS/pdns", "vendor": "PowerDNS", "modules": ["Catalog Zones"], "product": "Authoritative", "versions": [{"status": "affected", "version": "4.9.0", "lessThan": "4.9.15", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.5", "versionType": "semver"}], "packageName": "pdns", "programFiles": ["auth-catalogzone.cc"], "collectionURL": "https://repo.powerdns.com/", "defaultStatus": "unaffected"}], "datePublic": "2026-05-19T22:00:00.000Z", "references": [{"url": "https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail", "supportingMedia": [{"type": "text/html", "value": "<p>Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-05-21T09:25:03.315Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42396", "state": "PUBLISHED", "dateUpdated": "2026-05-21T12:03:16.000Z", "dateReserved": "2026-04-27T08:53:58.839Z", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "datePublished": "2026-05-21T09:25:03.315Z", "assignerShortName": "OX"}, "dataVersion": "5.2"}