CVE-2026-52688: RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
Published Jul 23, 2026
·Updated
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
Affected Software
2 affected componentsFixes available
Nlnet Labs Unbound<1.21.1
alpine/pdns-recursor<5.4.4-r0
5.4.4-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/pdns-recursorto a version that resolves this vulnerability.Fixed in 5.4.4-r0
Event History
Jul 23, 2026
CVE Published
via MITRE·08:03 AM
Data Sourced
via MITRE·08:03 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeakness
Data Sourced
via OSV·09:16 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-52688?
CVE-2026-52688 has a severity rating of high, with a score of 7.5.
2
What does CVE-2026-52688 affect?
CVE-2026-52688 affects DNSSEC validation due to RRSIGs with too few labels.
3
How can CVE-2026-52688 be mitigated?
To mitigate CVE-2026-52688, ensure that your DNSSEC implementation properly handles RRSIGs with adequate label counts.
4
What is the risk associated with CVE-2026-52688?
CVE-2026-52688 has a risk rating of 45, indicating a significant potential impact if exploited.
5
What should I do if I am vulnerable to CVE-2026-52688?
If vulnerable to CVE-2026-52688, you should review and update your DNSSEC configurations to prevent wildcard validation bypass.