Bug 2506361 (CVE-2026-52684)

Summary:	CVE-2026-52684 pdns-recursor: prefetch feature allows persistent ghost domain cache poisoning attack
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2506754, 2506753
Bug Blocks:

Description OSIDB Bzimport 2026-07-23 09:01:25 UTC

If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the 
child records are used immediately if not expired and thus valid, or the
 records are expired, and in that case not used.  So this case 
can only happen if almost expired records are used to refresh the 
authoritative NS records.