A race condition in PowerDNS Recursor allows concurrent transfers of the same RPZ zone to corrupt internal data structures, resulting in use‑after‑free errors that cause the recursor process to crash. The vulnerability can lead to availability loss but does not provide direct access to data or control of the system.

All versions of PowerDNS Recursor that have not applied the fix referenced in the PowerDNS advisory are affected. The exact version range is not specified, so any unsupported or older release should be considered vulnerable until the patch is applied.

The CVSS score of 5.0 classifies this as a moderate severity vulnerability. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can influence or impersonate an RPZ provider to cause concurrent RPZ zone transfers, which is less common but still possible if communications are not authenticated or validated.