CVE-2026-24027 exploits a flaw in PowerDNS Recursor where specially crafted zone data can cause the service to process an unusually high volume of queries. The result is an escalation of incoming network traffic that can overwhelm the recursor, compromising its availability. The weakness falls under improper resource consumption, aligned with CWE‑294.

The vulnerability affects the PowerDNS Recursor product. No specific version information is provided in the CNA data, so all installations of PowerDNS Recursor remain potentially impacted until a patch is applied.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely to be common. The vulnerability is not listed in the CISA KEV catalog. Attackers could remotely trigger the effect by sending crafted zone queries over the network, making the attack vector remote and external. The overall risk is moderate, primarily due to the availability impact and the low probability of exploitation.