The vulnerability allows an attacker to forge DNS responses that convince the Recursor that a legitimate authoritative server does not support EDNS. Because the Recursor then rejects or degrades validation of DNSSEC records from that server, any DNSSEC‑protected domain served by the affected authoritative source becomes unresolvable for clients relying on this Recursor, effectively denying access to those domains.

The flaw is present in PowerDNS Recursor, a DNS recursive resolver used by many organizations to provide name resolution to end users. Any environment that deploys this version of Recursor and forwards queries to authoritative servers vulnerable to the spoof, without proper validation configured, is at risk.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score is not available, so the current exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. The attack can be carried out by injecting malicious DNS replies over the network path between the Recursor and the authoritative server, most likely via UDP or TCP. Once a response is spoofed, the Recursor’s internal state changes to consider that server as non‑EDNS, causing DNSSEC validation failures for subsequent queries. The impact is limited to the affected resolver and its downstream clients, but it can disrupt DNSSEC‑only domain access within an organization.