A flaw in PowerDNS Recursor allows an attacker to craft RRSIG records with an insufficient number of domain labels, which bypasses wildcard validation performed on DNSSEC‑signed zones. The defect causes the validator to mistakenly accept an RRSIG that should be rejected, potentially allowing forged DNS responses to be considered legitimate and leading to DNS spoofing or denial of service. The weakness is aligned with CWE‑295 and CWE‑345, indicating inadequate verification of security metadata and lack of authentication controls.

The vulnerability affects PowerDNS Recursor implementations that rely on DNSSEC wildcard validation. All versions prior to the release noted in the PowerDNS advisory are affected, though the advisory does not specify exact version ranges. Systems that use PowerDNS Recursor for recursive resolution and enable DNSSEC checking are the primary targets.

The CVSS score of 7.5 signals a high severity flaw, but the EPSS score of less than 1% indicates that, as of now, exploitation is unlikely to be widespread. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the typical attack path would involve an attacker who can influence RRSIG data—such as a compromised authoritative server or a man‑in‑the‑middle on the path to an authoritative zone—to supply a payload with too few labels. The attacker can then trigger a recursive query from the vulnerable PowerDNS Recursor, forcing the server to accept the forged record and return a false answer to clients.