Critical Vulnerability in PDNS Package: CVE-2026-42396
Summary
DEBIAN-CVE-2026-42396: ... Affects pdns versions 4.4.1-1 – 5.0.4-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PDNS (PowerDNS) is an open-source DNS server software that provides authoritative DNS services and recursive DNS resolution. It is widely used for its flexibility, performance, and support for various DNS protocols. However, the PDNS package has been identified with a critical vulnerability (CVE-2026-42396) that affects multiple Debian distributions, potentially compromising the security of DNS services.
Vulnerability Detail
CVE-2026-42396 is a critical vulnerability affecting the PDNS package across several Debian distributions, including Debian 11 (Bullseye), Debian 12 (Bookworm), Debian 13 (Trixie), and Debian 14 (Forky). This vulnerability arises from a flaw in the handling of DNS queries, which could allow an attacker to exploit the system, leading to unauthorized access or denial of service. The urgency of this vulnerability is classified as 'end-of-life' for Debian 11 and 12, indicating that these versions are no longer supported and may not receive necessary security updates.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the PDNS service by configuring firewall rules to limit incoming traffic or by disabling the PDNS service until a patch is applied. For example, to stop the PDNS service, use the command:
sudo systemctl stop pdns'.
Conclusion
The CVE-2026-42396 vulnerability in the PDNS package poses a serious threat to users of Debian distributions. It is crucial to update to the latest patched version or implement workarounds to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for pdns →
FAQ
CVE-2026-42396 is a critical vulnerability in the PDNS package that affects multiple Debian distributions, allowing potential unauthorized access or denial of service.
The vulnerability affects Debian 11 (Bullseye), Debian 12 (Bookworm), Debian 13 (Trixie), and Debian 14 (Forky).
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update your PDNS package, consider implementing firewall rules to restrict access or temporarily disabling the service until a patch is available.
Yes, continuing to use an affected version poses significant security risks, including potential unauthorized access and service disruptions.
References
Related vulnerabilities
Recent vulnerabilities recorded for pdns.
