A missing consistency check in the zoneToCache function allows an attacker to craft a malicious zone that causes a null pointer dereference in PowerDNS Recursor, resulting in an application crash and loss of service. The vulnerability directly lowers availability and can be triggered by delivering a specially crafted zone file to a recursor that otherwise accepts external zones for resolving queries. The primary weakness is lack of proper input validation before accessing internal data structures.

This flaw affects the PowerDNS Recursor. No specific affected versions are listed in the advisory, so all releases that use the unpatched zoneToCache routine are potentially vulnerable until the vendor issues a fix.

The CVSS score is 4.4, indicating moderate severity. EPSS is not available, and the flaw is not yet listed in the CISA KEV catalog, showing it is not widely exploited yet. The likelihood of exploitation depends on an attacker’s ability to control an authoritative server or otherwise deliver a malicious zone to the recursor. If such conditions are met, the attacker can force the recursor to crash, causing a denial of service for users querying that recursor. The risk is mitigated by upgrading once a fix is released or by restricting zone sources.