A flood of perfectly timed queries can force DNSdist to misalign the identifiers used for TCP or DNS over TLS back‑end sessions, resulting in responses not matching the intended queries. The consequence is that the resolver may deliver incorrect, stale, or no answers, effectively degrading DNS service quality or availability. This weakness is identified as integer overflow (CWE‑190).

The product affected is PowerDNS DNSdist, a DNS load‑balancer and forwarder. No specific version range is listed in the advisory, so all installations of DNSdist remain potentially vulnerable until patched.

The CVSS score of 3.1 indicates a low severity risk. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting limited exploitation evidence. The likely attack scenario requires a client to send a high volume of tightly timed queries to a backend that accepts only TCP or TLS, which could be feasible on an open or poorly protected network. Given the low severity and lack of documented exploitation, the primary concern is operational disruption rather than a catastrophic breach.