Bug 296983 - dns/powerdns-recursor: Update to 5.4.4 (fixes multiple CVE)
Summary: dns/powerdns-recursor: Update to 5.4.4 (fixes multiple CVE)
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Koichiro Iwao
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-07-22 19:03 UTC by Jordan Ostreff
Modified: 2026-08-05 06:22 UTC (History)
2 users (show)

See Also:
tremere: maintainer-feedback+

Attachments
dns/powerdns-recursor 5.4.4 (1.18 KB, patch)
2026-07-22 19:03 UTC, Jordan Ostreff 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jordan Ostreff 2026-07-22 19:03:24 UTC 
Created attachment 273086 [details]
dns/powerdns-recursor 5.4.4

CVE-2026-52688: RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
CVE-2026-62686: Wildcard CNAME proof validation bypass

https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html#cve-2026-52688-rrsigs-with-too-few-labels-can-lead-to-bypass-of-dnssec-wildcard-validation
Comment 1 Koichiro Iwao freebsd_committer freebsd_triage 2026-07-30 00:18:21 UTC 
I will wait for maintainer approval.
Comment 2 Ralf van der Enden 2026-08-03 07:39:11 UTC 
Sorry for the delay, but I was away on holiday.

Looks good to me. Thanks
Comment 3 Jordan Ostreff 2026-08-04 20:27:40 UTC 
(In reply to Ralf van der Enden from comment #2)
Thanks!
Comment 4 commit-hook freebsd_committer freebsd_triage 2026-08-05 04:46:36 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=51339cf9613a8e98ba328463eb38e430bdf74ca8

commit 51339cf9613a8e98ba328463eb38e430bdf74ca8
Author:     Koichiro Iwao <meta@FreeBSD.org>
AuthorDate: 2026-08-05 04:43:12 +0000
Commit:     Koichiro Iwao <meta@FreeBSD.org>
CommitDate: 2026-08-05 04:44:34 +0000

    dns/powerdns-recursor: Update to 5.4.4

    PR:             296983
    Security:       575ddefc-9085-11f1-b295-98b78501ef2a
    Security:       CVE-2026-52686
    Security:       CVE-2026-52688

 dns/powerdns-recursor/Makefile | 3 +--
 dns/powerdns-recursor/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)
Comment 5 commit-hook freebsd_committer freebsd_triage 2026-08-05 04:46:37 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=1aba68a4343fd39094146c52146735a3073f6084

commit 1aba68a4343fd39094146c52146735a3073f6084
Author:     Koichiro Iwao <meta@FreeBSD.org>
AuthorDate: 2026-08-05 04:40:44 +0000
Commit:     Koichiro Iwao <meta@FreeBSD.org>
CommitDate: 2026-08-05 04:44:34 +0000

    security/vuxml: Document dns/powerdns-recursor vulnerabilities

    PR:             296983

 security/vuxml/vuln/2026.xml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
Comment 6 commit-hook freebsd_committer freebsd_triage 2026-08-05 06:18:56 UTC 
A commit in branch 2026Q3 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=4e1f388f7d920222a7bdeefe7e62ee2dd2fbd434

commit 4e1f388f7d920222a7bdeefe7e62ee2dd2fbd434
Author:     Koichiro Iwao <meta@FreeBSD.org>
AuthorDate: 2026-08-05 04:43:12 +0000
Commit:     Koichiro Iwao <meta@FreeBSD.org>
CommitDate: 2026-08-05 04:48:08 +0000

    dns/powerdns-recursor: Update to 5.4.4

    PR:             296983
    Security:       575ddefc-9085-11f1-b295-98b78501ef2a
    Security:       CVE-2026-52686
    Security:       CVE-2026-52688

    (cherry picked from commit 51339cf9613a8e98ba328463eb38e430bdf74ca8)

 dns/powerdns-recursor/Makefile | 2 +-
 dns/powerdns-recursor/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)
Comment 7 Koichiro Iwao freebsd_committer freebsd_triage 2026-08-05 06:22:32 UTC 
Committed, please add the vuxml entry as well next.