The vulnerability permits an attacker to supply DNS zones with specially crafted records, including CNAME chains, that cause the Recursor to consume a significant amount of memory and CPU, or to store incorrect information in its cache, leading to denial of service or cache poisoning. This is a CWE‑770 type flaw where excessive resource consumption can be triggered by user input.

All installations of PowerDNS Recursor are potentially vulnerable. The CVE lists the product but does not specify affected releases, so any deployment of Recursor could be impacted.

The CVSS score of 5.3 reflects a moderate risk, and the EPSS score of less than 1 % indicates a very low exploitation probability at the time of analysis. The issue is not in the CISA KEV catalog. The attack can be performed over the network by an adversary who can direct the Recursor to resolve zones under their control, exploiting the Recursor’s handling of zone data. No specific prerequisites other than the ability to query the Recursor are required.