Incomplete validation of the SOA record present in a catalog zone might lead to a crash. The vulnerability allows an attacker to trigger a denial‑of‑service condition by sending a malformed or unexpected SOA record that is not properly checked before processing. The resulting crash terminates the recursor process, disrupting DNS resolution for clients that rely on it. This weakness primarily affects availability and is an instance of improper input validation (CWE‑20).

PowerDNS Recursor is affected. No specific version information is provided in the advisory; administrators should verify whether their installed version falls within the range of releases that implement the fix, as documented by PowerDNS.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is currently not listed in CISA’s KEV catalog, suggesting limited evidence of active exploitation. The likely attack vector involves an adversary introducing a vulnerable catalog zone—either via a zone transfer or an authoritative source that the recursor accepts—so the flaw can be triggered by receiving untrusted zone data. While the risk of exploitation is moderate, the absence of widespread exploitation mitigates immediate concern, yet administrators should prepare to remediate promptly if they operate recursors that handle catalog zones.