CVE-2026-42390: ZONEMD Validation Bypass in ZoneToCache

Technical summary

CVE-2026-42390 describes a flaw in ZONEMD validation implementation where cryptographic signature verification does not correctly identify invalid zones. ZONEMD is a DNSSEC-adjacent mechanism that provides zone integrity verification through message digests. The vulnerability allows an invalid zone to bypass this validation gate when ZoneToCache is configured to enforce ZONEMD checks. This represents an improper input validation issue (CWE-20), where the validator fails to reject malformed or tampered zone data before caching it for use.

Business impact

If exploited, this vulnerability could allow DNS resolver poisoning at the caching layer. An attacker able to inject an invalid zone into a system relying on ZoneToCache with ZONEMD validation could cause that resolver to cache and serve fraudulent DNS responses to clients. The scope is limited to organizations running ZoneToCache with ZONEMD validation explicitly enabled—a relatively specialized configuration—but the impact on those systems could include traffic redirection, credential theft via spoofed domains, or service disruption.

Affected systems

Systems running ZoneToCache with ZONEMD validation enabled are affected. The source data does not specify vendor or product version information; organizations should consult the ZoneToCache project directly (verify against the vendor advisory) to determine if their deployment includes this component and configuration. ZONEMD is not a default validation mechanism in most DNS infrastructures, so exposure is limited to deliberate deployments of this specific security feature.

Exploitability

Exploitability requires network access to inject a specially crafted zone that fails validation but passes the vulnerable check. The attack does not require authentication or user interaction (CVSS vector AV:N/AC:L/PR:N/UI:N). However, practical exploitation depends on an attacker's ability to poison a zone source or intercept zone transfer traffic. The vulnerability is a validation bypass rather than a remote code execution vector, so the impact is integrity-focused rather than confidentiality or availability threats.

Remediation

Identify all instances of ZoneToCache in your environment with ZONEMD validation enabled. Await a patch from the ZoneToCache maintainers that corrects the validation logic to properly reject invalid zones. Until patched, consider disabling ZONEMD validation if the operational risk is acceptable, or isolating affected resolvers to lower-risk network segments. Test any patch thoroughly in a staging environment before production deployment.

Patch guidance

Verify the ZoneToCache project's official security advisory for patch availability and version numbers. The source data does not specify a patched version; consult the maintainer's release notes to confirm the fix. Apply patches according to your change management process, prioritizing systems in direct zone-serving roles or those in high-traffic resolver positions.

Detection guidance

Monitor ZoneToCache logs for zone validation events, particularly those that log or track ZONEMD validation passes. Correlate with zone transfer logs to identify any unusual or unexpected zone sources. Network-level detection is challenging without zone content inspection; focus on process and configuration monitoring to confirm ZONEMD validation remains properly configured post-remediation. Consider periodic zone integrity audits using external DNSSEC validators.

Why prioritize this

Although the CVSS score of 5.3 (MEDIUM) reflects the integrity-only impact and network requirement, prioritization should account for the specialized nature of the vulnerable configuration. Organizations not running ZoneToCache with ZONEMD validation face no risk. Those that do should prioritize patching because DNS integrity is foundational to service availability and trust. Patch this within your normal maintenance window, but do not delay if this component is critical to zone security posture.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible vulnerability with low attack complexity and no authentication requirement, but limited to integrity impact with no confidentiality or availability effect. The score appropriately captures that exploitation requires specific configuration and targeted injection, not widespread Internet-scale attack. The moderate rating aligns with the targeted scope and integrity-only impact; however, the criticality of DNS in your infrastructure may warrant treating this as a higher operational priority despite the base score.

Frequently asked questions