PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42002 PowerDNS CVE debrief

CVE-2026-42002 is a medium-severity vulnerability description centered on concurrency and locking defects in GSS-TSIG. The available record indicates a network-reachable issue with high attack complexity and an availability impact only, which points to denial-of-service risk rather than confidentiality or integrity compromise. NVD shows the record as "Received" and references a PowerDNS security advisory, but the supplied corpus does not include the advisory text itself, so implementation details and product scope should be treated cautiously until confirmed from the vendor advisory.

Vendor
PowerDNS
Product
Authoritative
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-21
Original CVE updated
2026-05-21
Advisory published
2026-05-21
Advisory updated
2026-05-21

Who should care

Operators and administrators responsible for systems that use GSS-TSIG, especially DNS infrastructure teams and anyone monitoring the referenced PowerDNS advisory. Security teams should also care if they track medium-severity availability issues that can still disrupt critical name resolution services.

Technical summary

The supplied NVD metadata describes CVE-2026-42002 as "Concurrency and locking defects in GSS-TSIG" with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. That combination suggests a remotely reachable flaw that is harder to trigger than a typical low-complexity bug, with impact limited to availability. The record includes a reference to a PowerDNS advisory, but the corpus does not provide the advisory body, affected versions, or remediation guidance. Vendor attribution is therefore low confidence in this dataset and should be verified against the official advisory before taking product-specific action.

Defensive priority

Moderate. The CVSS score is 5.9 (MEDIUM), but the issue may still matter operationally because it can affect availability in DNS-related services. Prioritize validation of exposure and vendor guidance, especially where service continuity is important.

Recommended defensive actions

  • Check whether any deployed DNS or GSS-TSIG-enabled components correspond to the referenced PowerDNS advisory before making changes.
  • Review the official PowerDNS advisory for affected versions and remediation guidance once the advisory text is available.
  • Inventory any systems that rely on GSS-TSIG for authentication or inter-server communication.
  • Monitor for availability anomalies, lockups, or service instability in the affected DNS path.
  • Plan patching or upgrade windows according to vendor guidance, with special attention to production DNS infrastructure.
  • Track the CVE and NVD record for updates because the current NVD entry is marked "Received" and details may change.

Evidence notes

This debrief is based only on the supplied NVD record and its single referenced PowerDNS advisory link. The source corpus provides the CVE description, CVSS vector, publication timestamp, and reference URL, but not the advisory content, affected versions, or fix details. Vendor identity is therefore uncertain in the supplied data and should be treated as low-confidence.

Official resources

Published CVE date used for timing context: 2026-05-21T10:16:25.800Z. The source record was modified at the same timestamp in the supplied corpus. No KEV listing is indicated in the provided data.