CVE-2026-40012: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-40012 is an information disclosure vulnerability in PowerDNS Recursor where EDNS Client Subnet (ECS) zero-scoped DNS answers are incorrectly stored in the packet cache when they should not be. This flaw affects only deployments with ECS enabled and was published on June 25, 2026. Affected versions include PowerDNS Recursor 5.2.0–5.2.10, 5.3.0–5.3.7, and 5.4.0–5.4.2. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-524 (Use of Cache Containing Sensitive Information) and CWE-668 (Exposure of Resource to Wrong Sphere). In ECS-enabled configurations, PowerDNS Recursor incorrectly caches DNS responses that carry a zero-scope ECS option — responses that authoritative servers intend to be non-cacheable or client-specific — into the shared packet cache. This means subsequent DNS queries from different clients may receive cached answers that were originally intended only for a specific ECS scope, leaking DNS response data across client boundaries. No authentication or user interaction is required to trigger this behavior, as it is exploitable remotely over the network (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in limited confidentiality impact: unauthenticated network-based attackers can retrieve cached DNS answers that were intended to be zero-scoped and not served to arbitrary clients, potentially disclosing DNS response information across client boundaries. There is no integrity or availability impact. The vulnerability is scoped to DNS response data and does not enable code execution, lateral movement, or access to underlying system resources (GitHub Advisory, Red Hat Bugzilla).

PowerDNS has released patched versions addressing this vulnerability: Recursor 5.2.11, 5.3.8, and 5.4.3. Administrators should upgrade to one of these fixed releases as the primary remediation. If immediate patching is not feasible, disabling ECS (EDNS Client Subnet) functionality is an effective workaround, as the vulnerability only affects configurations with ECS enabled (GitHub Advisory, Red Hat Bugzilla).

PowerDNS published a dedicated security advisory (powerdns-advisory-2026-08) for this vulnerability, and Red Hat tracked it via Bugzilla as a medium-severity issue. The vulnerability was also disclosed on the oss-security mailing list and picked up by downstream distributors including Debian and FreeBSD, which issued package updates. No notable independent researcher commentary or significant social media discussion has been observed beyond routine vulnerability tracking.