The vulnerability allows an attacker to consume backend connection resources by repeatedly issuing IXFR queries, which keeps outbound TCP connections to the backend open until a timeout. This is a classic resource exhaustion weakness (CWE-772). The resulting resource saturation can lead to a denial of service when the number of concurrent connections is exhausted or the process runs out of file descriptors.

It affects the PowerDNS DNSdist product. No specific affected version is listed in the advisory, so all current and prior releases may be vulnerable until a patch is released.

The CVSS score of 5.3 indicates medium severity. The exploit probability is unknown, as EPSS is not available, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is remote network, making it accessible to adversaries who can send IXFR queries from any IP. If an attacker can flood the server with such queries, a denial of service could occur, impacting availability of services relying on the DNS backend.