Hi,

The following vulnerability was published for pdns-recursor.

It ws not important renough to get in in the last round of updates
AFAIU.

CVE-2026-52684[0]:
| If the auth responds very slowly and the records expire in between,
| the capping of TTLs is not enforced for lack of data. This does not
| happen on regular resolve as then then the  child records are used
| immediately if not expired and thus valid, or the  records are
| expired, and in that case not used.  So this case  can only happen
| if almost expired records are used to refresh the  authoritative NS
| records.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-52684
https://www.cve.org/CVERecord?id=CVE-2026-52684
[1] https://github.com/PowerDNS/pdns/pull/17748

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore