The Recursor mistakenly stores ECS zero scoped answers in its packet cache, leading to potential leakage of sensitive data to clients that query the DNS server. The flaw results in a confidentiality breach where endpoints may receive domain resolution information that should remain private. This is an input validation and caching weakness that can expose various records to unauthorized parties.

PowerDNS:Recursor is affected. All installations with ECS enabled are potentially vulnerable, as no specific version details are provided.

The CVSS score of 5.3 places the issue in a moderate range. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA KEV catalog. Attack vectors are likely through legitimate DNS queries from clients to the Recursor when ECS is enabled, allowing the attacker to obtain cached answers that were not meant for public dissemination.