Technical impact
The vulnerability is a null pointer access triggered during the transition of a DNS zone from NSEC to NSEC3, causing an internal inconsistency that leads to the PowerDNS Recursor crashing. This crash interrupts DNS resolution for clients that query the affected zone, resulting in a denial of service. The weakness is reflected in CWE‑353 (Race Condition).
Affected Systems
The issue affects PowerDNS Recursor, specifically the 5.4.0 release as identified by the advisory. Any deployment of this version, regardless of operating system or deployment method, is potentially vulnerable. Earlier or later releases may not contain the flaw.
Risk and Exploitability
The CVSS base score of 5.9 indicates a medium severity. The vulnerability is triggered by a zone transition from NSEC to NSEC3, which may occur during zone data updates or reconfiguration. No explicit exploitation method is documented; the crash occurs only when the transition happens. The EPSS score is <1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation is not currently observed. Based on the description, it is inferred that an actor who can induce the zone transition—such as a misconfigured zone author or a malicious zone transfer—could trigger repeated crashes.
Debian DSA