CVE-2026-42004 — EDNS options smuggling

CVE-2026-42004

EDNS options smuggling PUBLISHED

Description (CNA)

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

Affected (CNA)

Vendor / product	Versions
PowerDNS / DNSdist	affected 1.9.0 before 1.9.15; affected 2.0.0 before 2.0.7

CWE

No CWE identifiers supplied.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.