CVE-2026-42387: DNS Recursor Denial of Service via Malicious Zone

Technical summary

CVE-2026-42387 is an input validation flaw (CWE-20) in the ZoneToCache function of DNS recursors. When a malicious authoritative server delivers a crafted zone, insufficient validation allows the zone data to reach a code path that causes a crash. The vulnerability is reachable only over the network from an attacker who either controls or has compromised an authoritative nameserver. No user interaction is required, but the attack complexity is high because the attacker must construct a specific payload and ensure the recursor processes it.

Business impact

Exploitation causes availability loss for DNS resolution services. If a recursor handles queries for critical internal or external domain infrastructure, a crash disrupts name resolution for dependent applications and users. Recovery typically requires manual intervention or automated restart mechanisms. The financial impact depends on the recursor's role: a public resolver outage affects many users; an enterprise recursor outage isolates internal services. Repeated crashes could trigger incident response overhead and reputational damage if external-facing.

Affected systems

The vulnerability affects DNS recursor implementations that use a ZoneToCache function and lack input validation on zone data received from authoritative servers. Specific product names and versions are not listed in the source data. Organizations should identify which DNS resolver software they deploy and cross-reference vendor advisories to determine if patches are available.

Exploitability

Exploitation requires network access and control over an authoritative DNS server in the query path. The attack is not trivial: the attacker must craft a specific malicious zone payload that triggers the crash when processed by the recursor's ZoneToCache logic. Automated scanning is unlikely to detect vulnerable recursors without active interaction. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects medium severity: network-reachable but high complexity, with impact limited to availability.

Remediation

Apply vendor patches as soon as they become available. Verify the patch addresses input validation in the ZoneToCache function. Until patched, consider restricting which authoritative servers a recursor accepts zone transfers from, implementing network segmentation to limit authoritative server communication, or deploying rate-limiting and crash-recovery automation to minimize downtime from DoS attempts.

Patch guidance

Contact your DNS recursor vendor for patch availability and timelines. Patches should validate zone data before processing in ZoneToCache to reject malformed or oversized records. Test patches in a staging environment before production deployment, as DNS recursors are often critical infrastructure. Verify patch completeness by checking vendor advisories and security bulletins specific to your resolver implementation.

Detection guidance

Monitor recursor processes for unexpected crashes or restarts, particularly if correlated with DNS zone transfer attempts or unusual query patterns from authoritative servers. Log and alert on malformed zone data rejection if the resolver implements such logging. Network-based detection is difficult without access to zone transfer traffic; focus on behavioral anomalies such as sudden loss of resolution service or recursor availability dips. Ensure crash logs are retained for forensic analysis.

Why prioritize this

This vulnerability merits prompt attention because it affects core DNS infrastructure availability. Although the CVSS score is medium and exploitation is complex, successful attacks cause immediate denial of service with no user action required. Organizations operating public or internal recursors should prioritize patching to prevent outages. The attack surface is limited to those who control authoritative servers, reducing the immediate threat scope but not eliminating it for organizations in adversarial network positions.

Risk score, explained

The CVSS 3.1 score of 5.9 (MEDIUM) reflects a network-reachable vulnerability with high attack complexity and severe impact on availability only. No confidentiality or integrity loss occurs; the attacker gains only the ability to crash the recursor. The score appropriately balances the ease of triggering denial of service (once a crafted zone is delivered) against the difficulty of gaining a position to deliver it. Organizations dependent on resolver uptime should treat this as higher priority than the numeric score alone suggests.

Frequently asked questions