<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title>Most recent entries from all</title>
    <link>https://vulnerability.circl.lu</link>
    <description>Contains only the most 10 recent entries.</description>
    <docs>http://www.rssboard.org/rss-specification</docs>
    <generator>python-feedgen</generator>
    <language>en</language>
    <lastBuildDate>Sun, 04 Oct 2026 05:46:45 +0000</lastBuildDate>
    <item>
      <title>CVE-2026-52684 — Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack</title>
      <link>https://vulnerability.circl.lu/vuln/cve-2026-52684</link>
      <description>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; PowerDNS Recursor&lt;/p&gt;
&lt;p&gt;If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the 
child records are used immediately if not expired and thus valid, or the
 records are expired, and in that case not used.  So this case 
can only happen if almost expired records are used to refresh the 
authoritative NS records.&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; PowerDNS Recursor&lt;/p&gt;
&lt;p&gt;If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the 
child records are used immediately if not expired and thus valid, or the
 records are expired, and in that case not used.  So this case 
can only happen if almost expired records are used to refresh the 
authoritative NS records.&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/vuln/cve-2026-52684</guid>
    </item>
  </channel>
</rss>
