A configuration change that moves a DNS zone’s security mechanism from NSEC to NSEC3 can trigger an internal inconsistency in PowerDNS Recursor. The inconsistency causes the recursor to crash, interrupting DNS resolution for clients that query the affected zone, resulting in a denial of service.

The vulnerability affects the PowerDNS Recursor component, regardless of the operating system or deployment method. No specific recursor version is listed in the advisory, so all deployments that have not applied a future patch should be considered potentially vulnerable.

The CVSS base score of 5.9 indicates a medium severity. The vulnerability is triggered by a zone transition from NSEC to NSEC3, which may occur during zone data updates or reconfiguration. No explicit exploitation method is documented; the crash occurs only when the transition happens. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation is not currently observed. Based on the description, it is inferred that an actor who can induce the zone transition—such as a misconfigured zone author or a malicious zone transfer—could trigger repeated crashes.