CVE-2026-52690: DNS Recursor EDNS Spoofing Vulnerability Undermines DNSSEC Validation

Technical summary

CVE-2026-52690 exploits a weakness in how DNS recursors handle EDNS negotiation. Attackers can craft and inject spoofed DNS responses that mislead a recursor into flagging an authoritative server as non-EDNS-compliant. This incorrect classification causes the recursor to strip EDNS options (including the DNSSEC OK flag) from future queries to that server. Consequently, DNSSEC-signed responses cannot be properly validated, as the signatures depend on EDNS-enabled communication. The vulnerability is classified under CWE-290 (Authentication Using a Single Factor), reflecting that the attack succeeds due to insufficient validation of the EDNS capability assertion.

Business impact

Organizations operating DNS infrastructure or relying on DNSSEC-validated domain resolution face service degradation. If an authoritative nameserver is falsely marked as non-EDNS-capable, queries for domains it serves will fail validation, potentially rendering those domains inaccessible to recursive resolvers that enforce DNSSEC. This affects both public-facing services and internal DNS-dependent applications. The attack doesn't require administrative privileges or user interaction, making it a persistent threat to DNS availability and integrity. Domains with strict DNSSEC policies are most vulnerable, as broken validation chains lead to lookup failures rather than warnings.

Affected systems

Any DNS recursor software vulnerable to this spoofing attack is affected. The ground-truth data does not specify vendor or product names, so organizations should consult DNS software vendor advisories to determine if their recursor implementation (whether in bind, unbound, PowerDNS, or other packages) is affected. Authoritative nameservers themselves are not compromised; instead, they become collateral damage when recursors misclassify them. The attack is network-based and requires no special network positioning beyond the ability to inject packets into the path between the recursor and authoritative servers, or to spoof responses.

Exploitability

The CVSS 3.1 score of 5.9 (MEDIUM severity) reflects a network-accessible attack with high complexity but no privilege or user interaction required. The high complexity factor likely accounts for the precision needed to craft and insert spoofed replies before legitimate responses arrive. Exploitability does not require the attacker to be on-path for all traffic; timing-based or volume-based spoofing techniques (such as DNS amplification patterns) can be effective. The attack produces a denial-of-service effect by degrading DNSSEC validation, not by leaking secrets or gaining control. As this vulnerability is not listed in the CISA KEV catalog, no active in-the-wild exploitation has been documented as of the publication date, but organizations should not interpret this as low risk—spoofing attacks on DNS are well-established techniques.

Remediation

Patches must be obtained from your DNS recursor vendor. Verify the specific affected versions and remediation guidance by consulting vendor security advisories (e.g., if using BIND, check ISC; if using Unbound, check NLnet Labs). Patches will harden EDNS negotiation logic to prevent spoofed replies from incorrectly marking servers as EDNS-incapable. Until patching is possible, network-level mitigation such as rate-limiting DNS responses or using DNSSEC-aware firewalls may reduce attack surface, though these do not eliminate the underlying flaw. Organizations should prioritize patching recursors in production, especially those serving multiple downstream clients or critical internal applications.

Patch guidance

Contact your DNS recursor vendor for patch availability and timelines. Do not assume that automatic updates are enabled; verify patching status explicitly in production environments. Test patches in staging before deployment, as DNS changes carry high operational risk. If your vendor has not yet released a patch, maintain communication with them and plan for rapid deployment when available. Document your recursor version and DNS architecture to streamline patching workflows. Consider deploying multiple independent recursors to reduce single-point-of-failure risk during the patching window.

Detection guidance

Monitor recursor logs for patterns of EDNS negotiation failures with specific authoritative servers. A sudden increase in validation failures for DNSSEC-signed zones, particularly from a subset of authoritative servers, may indicate an active spoofing campaign. Implement DNS query logging and analyze for anomalies in response code distribution (watch for SERVFAIL responses on valid domains). Packet capture analysis can reveal spoofed or out-of-order replies if forensic investigation is warranted. Tools like dnstop or query-log analysis can help identify affected zones and servers. Set alerts on recursor metrics for EDNS flag failures or DNSSEC validation breakage correlating with specific upstream servers.

Why prioritize this

Although the CVSS score is MEDIUM and no public exploitation is documented, this vulnerability directly undermines DNSSEC integrity, a critical security control for DNS. The attack is network-based, requires no credentials, and can be triggered by any attacker with network access. Organizations with strict DNSSEC policies or domains requiring high assurance are at elevated risk. Priority should be given to recursors handling traffic for security-sensitive domains or serving as infrastructure-critical resolvers. The high complexity barrier (CVSS AC:H) should not defer patching; complexity may simply reflect attack difficulty, not vulnerability severity.

Risk score, explained

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H yields a score of 5.9 (MEDIUM). Attack Vector is Network, reflecting that no special access is needed. Attack Complexity is High, likely due to the need to inject spoofed replies with precise timing. Privileges Required and User Interaction are None, increasing base severity. Scope is Unchanged (the attack does not break out of the DNS protocol boundary). Confidentiality and Integrity impacts are None (no data leakage or tampering beyond DNSSEC validation failure). Availability impact is High, as legitimate DNSSEC-signed responses become unusable. This is fundamentally a DNS availability attack.

Frequently asked questions