This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-40012 →
DEBIAN-CVE-2026-40012
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
Original description
The description as published by the source.
ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
pdns-recursor
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
pdns-recursor
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.11-0+deb13u1"}]}]
Debian:14
pdns-recursor
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.3-1"}]}]
References
- advisory security-tracker.debian.org