A recent PowerDNS vulnerability allows an attacker to craft a notify message that adds a secondary domain to the bind backend. The backend's configuration is then overwritten with an invalid value, causing the service to fail on the next restart. The impact is a denial of service, as the authoritative server cannot start without manual intervention. The weakness is related to unsanitized domain names being inserted into configuration files (CWE‑94).

PowerDNS Authoritative DNS servers that use a bind backend are affected. The advisory lists the product as PowerDNS:Authoritative with unspecified impacted versions; any installation that processes notify requests without proper validation is vulnerable.

The CVSS score of 7.4 indicates high severity. The exploit requires the attacker to send a crafted notify request to a vulnerable PowerDNS instance; the attack vector is remote network access to the DNS server. There is no known public exploit at this time, and the vulnerability is not listed in the CISA KEV catalog. However, once exploited it can bring the authoritative service down until a manual reset or patch is applied.