PowerDNS Security Advisory 2026-10 for PowerDNS Recursor: Multiple issues

------=_Part_2217_1426325684.1784717567813
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

   Today we have released PowerDNS Recursor 5.2.12, 5.3.9 and 5.4.4.

   These releases provide fixes for PowerDNS Security Advisory

     * 2026-10 for PowerDNS Recursor: Multiple issues

   There are two CVEs associated with this advisory, one with severity
   High and one with severity Low.
     __________________________________________________________________

     * CVE-2026-52688: RRSIGs with too few labels can lead to bypass of
       DNSSEC wildcard validation
     * CVE-2026-62686: Wildcard CNAME proof validation bypass

   Please refer to the changelogs  ([1]5.2.12, [2]5.3.9 and [3]5.4.4) and
   the full [4]security advisory for additional details.

   Please send us all feedback and issues you might have via
   the [5]mailing list, or in case of a bug, via [6]GitHub.

   The tarballs ([7]5.2.12, [8]5.3.9, [9]5.4.4) (with signature files
   [10]5.2.12, [11]5.3.9, [12]5.4.4) are available from our
   download [13]server and packages for several distributions are
   available from our [14]repository.

   Recently we made changes to our Open Source End of Life policy. Older
   release trains are now supported for one year after the following major
   release. Consult the EOL [15]policy for more details.

   We are grateful to the PowerDNS community for the reporting of bugs,
   issues, feature requests, and especially to the submitters of fixes and
   implementations of features.

References

   1. https://doc.powerdns.com/recursor/changelog/5.2.html#change-5.2.12
   2. https://doc.powerdns.com/recursor/changelog/5.3.html#change-5.3.9
   3. https://doc.powerdns.com/recursor/changelog/5.4.html#change-5.4.4
   4. https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html
   5. https://mailman.powerdns.com/mailman/listinfo/pdns-users
   6. https://github.com/PowerDNS/pdns/issues/new/choose
   7. https://downloads.powerdns.com/releases/pdns-recursor-5.2.12.tar.bz2
   8. https://downloads.powerdns.com/releases/pdns-recursor-5.3.9.tar.xz
   9. https://downloads.powerdns.com/releases/pdns-recursor-5.4.4.tar.xz
  10. https://downloads.powerdns.com/releases/pdns-recursor-5.2.12.tar.bz2.sig
  11. https://downloads.powerdns.com/releases/pdns-recursor-5.3.9.tar.xz.sig
  12. https://downloads.powerdns.com/releases/pdns-recursor-5.4.4.tar.xz.sig
  13. https://downloads.powerdns.com/releases/
  14. https://repo.powerdns.com/
  15. https://docs.powerdns.com/recursor/appendices/EOL.html
------=_Part_2217_1426325684.1784717567813
Content-Type: application/pgp-signature; name=signature.asc
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=signature.asc
X-Part-Id: 113e08a2e10a45a6a18c35ad32d47174

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0NClZlcnNpb246IEJDUEcgdjEuNzkNCg0KaVFF
Y0JBQUJDZ0FHQllKcVlKa2NBQW9KRU9yS3VRc1pZK3dyTHNjSC8zMmVseG9RQnE4SE5HdEJuTVJz
T1RhMg0KeU1aVU1JdG01dVdaT2FCVlhrUk1EMVhYWHpUOEw4L1U1VkJpRjFsamV2YWVtVktCOE53
ajFNNXRwSEFKNW9JWQ0KL21YNmlHeldYYnlyUUhYdUY5eENKWXZZS1l5ZERSNGZ6NkxRdktkQjVx
dCtQb3k0RStiSXBMZ1M5QXVkRElTUw0KeXhuQ0xWMWJYSU9kY3NvQXR3MzgzaG1vR2phcCt5RmFz
S1lMcmlBY1NSYnNkZ2syZjREeXNQZVFpTW5Rak1qdQ0KSTByY0tBZ29MdjllZ3pJTW8rUzRMZUFT
RGlWRHNDR0RnOFozaWJESUY1WDJJelFjSmhuMmh5Rlh4UjE4djRXSg0KZ2FnaGFGN0ltNTNEQUtT
MTh0Z3ZxVnkwbTBCeVB4dC9JaG94SU9YRHhWdy9yZ3lpTVJkUUdTeHJnb1Y5K0NjPQ0KPTV6OTkN
Ci0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQ0K
------=_Part_2217_1426325684.1784717567813
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pdns-users mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-users

------=_Part_2217_1426325684.1784717567813--