A crafted domain zone can be published and then queried to trigger the allocation of large entries in the negative and aggressive NSEC(3) caches of a PowerDNS Recursor. The resulting memory consumption and potential slowdown constitute a denial‑of‑service condition, as the resolver may become memory‑bound or significantly slower to respond to legitimate queries. The weakness is a failure to bound cache resource usage, corresponding to the uncontrolled resource consumption category.

The vulnerability affects PowerDNS Recursor deployments. No specific version range is listed, so any installation of the recursor that has not applied an update that addresses the issue is potentially impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available for this entry. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it by creating an adversarial zone and making the recursor resolve it, which is a remote achievable scenario given that DNS lookups are typically performed over the network. Successful exploitation would cause resource exhaustion, leading to degraded service or outage of the DNS resolver.