The vulnerability originates from insufficient input validation in PowerDNS’s internal web server, which allows an adversary to craft an HTTP request that triggers unbounded memory allocation. The resulting memory exhaustion causes the process to crash or become unresponsive, leading to a Denial‑of‑Service condition for the DNS service. The flaw is a classic input‑validation weakness that permits resource exhaustion.

The flaw is present in PowerDNS Authoritative, DNSdist, and Recursor products. No specific versions are listed in the CNA data, so all publicly available releases that contain the internal web server component may be affected. Because the internal server is disabled by default, the issue only surfaces in installations that explicitly enable it.

The CVSS score of 5.3 classifies the vulnerability as moderate severity. EPSS indicates the exploit probability is very low (<1%), and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed yet. The attack vector is remote via the internal web server; however, since the server is typically bound to localhost, attackers would need network access to the host or a misconfiguration that exposes the endpoint. In the absence of a public exploit, the risk is limited to environments where the internal server is enabled and reachable from untrusted networks.