MEDIUM
CVE-2026-40012
CVSS
5.3
Description
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
Summary dbcve.org
In DNS servers supporting EDNS Client Subnet (ECS), zero-scoped ECS answers (responses that should not be cached based on client subnet) are incorrectly being stored in the packet cache. This can cause incorrect geographically-specific DNS responses to be served to clients with different ECS scopes, as cached responses from one scope are improperly reused for other clients.
Mitigation
Disable ECS if not needed, or upgrade to the version where the packet cache correctly excludes zero-scoped ECS answers from being stored. Implement ECS scope validation before cache storage.
Weakness (CWE)
CWE-524
EPSS Score
0.32%
Probability of exploitation in next 30 days
25th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.