CVE-2026-40012: DNS ECS Cache Leakage Vulnerability

Technical summary

CVE-2026-40012 describes an improper cache management flaw in DNS servers implementing EDNS Client Subnet. ECS zero-scoped answers—responses that should not be cached or should have restricted scope—are incorrectly stored in the shared packet cache without appropriate scope constraints. This violates the ECS specification's intent to maintain query privacy and response accuracy by subnet. The vulnerability is classified under CWE-524 (Unprotected Transport of Credentials) in the broader context of information leakage through caching mechanisms. The attack surface is limited to configurations that explicitly enable ECS functionality.

Business impact

The primary business risk is unintended information disclosure. Cached DNS responses may reveal query patterns, domain interest, or network topology to unauthorized parties who can trigger cache hits. In multi-tenant or privacy-sensitive environments, this can breach contractual SLA commitments around DNS query confidentiality. For public DNS operators and recursive resolvers, the impact scales with cache size and traffic volume. Organizations relying on ECS for geolocation-based load balancing or content delivery optimization face reduced query privacy guarantees.

Affected systems

This vulnerability affects DNS servers and recursive resolvers that have EDNS Client Subnet (ECS) enabled in their configuration. Systems without ECS are not vulnerable. The ground-truth data does not identify specific vendor or product versions; administrators must consult vendor advisories to determine if their DNS infrastructure is affected and which versions contain the flaw.

Exploitability

The vulnerability requires network access to trigger DNS queries but no authentication, user interaction, or special privileges. An attacker can observe cached responses by issuing carefully crafted queries and measuring response patterns. The CVSS 3.1 score of 5.3 (MEDIUM) reflects low attack complexity and high attack availability, offset by limited impact scope (confidentiality only, no integrity or availability loss). Real-world exploitation is feasible but depends on attacker ability to infer information from cache behavior.

Remediation

Disable EDNS Client Subnet if privacy is prioritized over geolocation functionality. If ECS is operationally necessary, apply vendor-provided patches that enforce strict scope boundaries on cached responses. Verify patches explicitly address zero-scoped answer handling. Monitor vendor security advisories for patched versions and deployment timelines specific to your DNS infrastructure.

Patch guidance

Consult your DNS vendor's security advisory for patch availability and version numbers. Apply patches to all recursive resolvers and authoritative servers with ECS enabled. Test patches in non-production environments to confirm ECS functionality and cache behavior remain correct. Patches should explicitly prevent zero-scoped answers from entering the packet cache or enforce client-subnet-specific expiration rules. Verify vendor documentation confirms the fix addresses CVE-2026-40012 before production deployment.

Detection guidance

Enable DNS query and response logging on affected servers to detect unusual cache hit patterns or responses to zero-subnet queries. Monitor for asymmetric response behavior (same query, different answers across clients) that may indicate scope leakage. DNS analytics tools can correlate query-response pairs to identify potential cache pollution. Implement cache integrity checks if your DNS platform supports them. Log all ECS-related configuration changes for audit trails.

Why prioritize this

While the CVSS score is MEDIUM, prioritize based on operational context: high priority for public DNS operators, privacy-centric organizations, and multi-tenant environments; moderate for internal corporate resolvers with limited external exposure. The scope is narrow (ECS-only), which reduces blanket risk, but the confidentiality impact justifies timely patching if ECS is in use. Organizations not using ECS can safely defer action.

Risk score, explained

CVE-2026-40012 scores 5.3 MEDIUM under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The score reflects network accessibility, low complexity, and lack of privilege or interaction requirements, offset by limited confidentiality impact and no integrity or availability consequences. The vulnerability does not enable service disruption or data modification, only information leakage through caching side-effects.

Frequently asked questions