Technical impact
An operator who can invoke the REST API on PowerDNS Authoritative can trigger the creation of malformed HTTPS or SVCB records. The insufficient validation of these record types can cause the internal LMDB database to be corrupted, which destroys data integrity and potentially stops the DNS service from responding correctly. The flaw is a manifestation of CWE‑190, an integer over‑ or under‑flow built into the record parsing logic.
Affected Systems
The affected product is PowerDNS Authoritative. The advisory does not list specific vulnerable versions, so any instance that uses the REST API and employs the LMDB backend is considered susceptible.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploit activity. The likely attack vector requires an authenticated user with REST API privileges; operators or compromised accounts could invoke the vulnerable API endpoint to induce database corruption.
Debian DSA