CVE-2026-52684: DNS TTL Privilege Escalation Vulnerability

CVE-2026-52684 Overview

CVE-2026-52684 affects the PowerDNS Recursor when the resolver refreshes almost-expired authoritative nameserver (NS) records. If the upstream authoritative server responds very slowly and the referenced records expire mid-transaction, the Recursor fails to enforce Time-To-Live (TTL) capping because the reference data required to apply the cap is no longer available. The condition does not occur during normal resolution paths, since child records are either used immediately while valid or discarded once expired. The issue is limited to the narrow refresh path for authoritative NS records and produces a low-severity integrity impact on cached DNS data.

Critical Impact
Under specific timing conditions, TTL values on refreshed authoritative NS records may exceed configured maximums, allowing stale or extended cache entries to persist longer than policy dictates.

Affected Products

PowerDNS Recursor (see the GitHub Pull Request Discussion for affected branches)
Deployments performing recursive DNS resolution with cached authoritative NS records
Recursor instances querying slow or degraded authoritative nameservers

Discovery Timeline

2026-07-23 - CVE-2026-52684 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-52684

Vulnerability Analysis

The vulnerability arises in the PowerDNS Recursor's cache refresh logic for authoritative NS records. When the resolver attempts to refresh records whose TTL is close to expiration, it issues a query to the authoritative server. If that server responds slowly and the in-cache records expire during the wait, the routine responsible for capping TTL values loses the input it needs to enforce the maximum TTL policy. The result is that returned records are accepted without the intended capping being applied.

Regular resolution flows are unaffected. Child records are either present and valid, in which case they are used immediately, or expired, in which case they are discarded. The unsafe state only exists during the refresh window for near-expired authoritative NS records.

Root Cause

The root cause is a race condition [CWE-362] between record expiry and the arrival of an authoritative response. The TTL-capping routine depends on the previous cached record set to compute a bounded TTL. When that reference set expires before the response is processed, the code path proceeds without applying the cap rather than rejecting or re-fetching the data.

Attack Vector

Exploitation requires an attacker-controlled or attacker-influenced authoritative server that responds with high latency during the specific refresh window for near-expired NS records. The attack complexity is high because the attacker must coordinate response timing with the victim resolver's cache state. Successful exploitation produces a low-integrity impact by allowing DNS records to be cached with TTLs above the resolver's configured limits.

No verified proof-of-concept code is published. Refer to the GitHub Pull Request Discussion for the maintainers' technical description of the flaw and remediation.

Detection Methods for CVE-2026-52684

Indicators of Compromise

Cached DNS records with TTL values exceeding the max-cache-ttl configuration setting on the Recursor.
Authoritative NS records that persist in cache longer than the operator-configured ceiling.
Elevated query latency to specific authoritative zones correlated with unusually long-lived cache entries.

Detection Strategies

Audit the Recursor cache periodically using rec_control dump-cache and compare observed TTLs against the configured maximum.
Correlate authoritative response latency metrics with cache TTL anomalies for the same zones.
Track PowerDNS Recursor version inventory to identify hosts running unpatched builds referenced in the upstream pull request.

Monitoring Recommendations

Enable Recursor logging for slow authoritative responses and record refresh events involving NS records.
Ship Recursor metrics and cache dumps to a centralized log platform for longitudinal analysis of TTL enforcement.
Alert when any cached record's remaining TTL exceeds the configured max-cache-ttl threshold.

How to Mitigate CVE-2026-52684

Immediate Actions Required

Upgrade PowerDNS Recursor to the fixed version incorporating the changes from the GitHub Pull Request Discussion.
Inventory all Recursor deployments and prioritize those exposed to untrusted or high-latency authoritative servers.
Review current max-cache-ttl settings to ensure operational limits match policy expectations.

Patch Information

The fix is tracked in the PowerDNS project's public pull request. Consult the GitHub Pull Request Discussion for the specific commits, affected branches, and release notes covering the corrected TTL capping logic.

Workarounds

Lower max-cache-ttl to reduce the practical impact of any uncapped TTL that slips through the refresh path.
Restrict recursive resolution to trusted client networks to limit exposure to attacker-influenced query patterns.
Monitor and rate-limit interactions with authoritative servers exhibiting abnormal latency profiles.

bash

# Configuration example: enforce a conservative cache TTL ceiling in recursor.conf
max-cache-ttl=86400
max-negative-ttl=3600