This vulnerability in PowerDNS Recursor involves allocation of resources without limits or throttling in its internal web server component. An attacker can exploit this by sending crafted web requests that cause the server to allocate unlimited memory, leading to denial of service conditions. The internal web server is disabled by default, which mitigates exposure unless explicitly enabled by an administrator. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with no privileges or user interaction required, causing availability impact only.

Successful exploitation results in denial of service due to uncontrolled memory consumption in the internal web server of PowerDNS Recursor. There is no impact on confidentiality or integrity. Since the internal web server is disabled by default, the risk is limited to environments where it is enabled.

No official patch or fix is currently confirmed. Since the internal web server is disabled by default, ensure it remains disabled unless necessary. Monitor vendor advisories for updates regarding patches or official remediation. Avoid enabling the internal web server unless required and apply any future updates promptly once available.