CVE-2026-52686
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Vulnerability in DNSSEC validation allows bypassing signature verification for wildcard expansion proofs (NSEC/NSEC3) when the answer is a CNAME or DNAME record.
Risk Assessment
An attacker can forge DNS responses, bypassing DNSSEC protection, leading to traffic redirection or phishing.
Recommendation
Apply the patch from the DNS software vendor. Temporarily consider disabling wildcard support in DNSSEC zones.
Other vulnerabilities in DNS resolver
See all- CVE-2026-46600High
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
- CVE-2026-33602Medium
A rogue backend can send a crafted UDP response with a query ID off by one relative to the maximum configured value, triggering an out-of-bounds write that leads to denial of service.
Original NVD description (English source)
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS