A rogue authoritative DNS server can send specially crafted DNS update requests to a PowerDNS secondary server that forwards them, exhausting the secondary server’s file descriptors. This exhaustion stops the server from opening any additional sockets, leading to an availability loss. The issue is a classic example of an uncontrolled resource consumption flaw (CWE‑400).

The vulnerability applies to PowerDNS Authoritative servers acting as DNS secondaries that forward update requests. No specific product versions are listed, so all current installations of this component should be considered at risk until a patch is applied.

The CVSS score of 5.9 indicates moderate severity. EPSS information is unavailable, so the current likelihood of exploitation is unclear, but the lack of a KEV listing suggests no known public exploits yet. The likely attack vector is a malicious primary server sending numerous update requests over an open forward‑dnsupdate channel, which an attacker could control if the primary is compromised or malicious.