An attacker who can send many crafted DNS queries to a DNSdist instance can cause a dynamically inserted block to have a value that produces invalid output on the Prometheus metrics endpoint. When this happens, Prometheus scrapers receive errors and are unable to collect metrics until the block expires, effectively denying service for the affected Prometheus instance.

The vulnerability affects the PowerDNS DNSdist product. Specific version information is not listed in the advisory, so all installations of DNSdist are considered potentially vulnerable until an official patch or release is applied.

The CVSS score is 3.7, classifying the flaw as low severity, and no EPSS score is available, indicating limited publicly documented exploitation. However, the attack can be performed entirely over the network by sending a flood of DNS requests with carefully crafted contents. The denial‑of‑service impact is limited to the Prometheus metrics endpoint and can cause temporary loss of monitoring data but does not compromise authentication or data confidentiality. The vulnerability is currently not listed in the CISA KEV catalog.