Insufficient validation of domain names during AXFR allows a DNS server to return zone data for an arbitrary or malformed name that should normally be rejected. This flaw arises from an input validation weakness identified as CWE-77. The consequence is a confidentiality breach, where sensitive DNS records could be disclosed to an attacker. The CVSS score of 6.8 reflects a moderate severity level for this type of data exposure.

The affected product is PowerDNS Authoritative. No specific version information is supplied by the CNA, so any deployment of PowerDNS that accepts AXFR requests and does not enforce strict name validation is potentially vulnerable. Administrators should verify against the vendor’s advisory to confirm whether their server release includes the fix.

The EPSS score of < 1% indicates little evidence of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely abused. The likely attack vector, based on the description, is a network‑based AXFR request originating from an external host directed at the DNS server. Successful exploitation would let the adversary retrieve zone data for any name without authorization, assuming the server does not already enforce name validation or limit AXFR access.