This vulnerability involves the allocation of resources without limits or throttling (CWE-770) in the internal web server component of PowerDNS Recursor. An unauthenticated attacker can send crafted web requests that cause the internal web server to allocate memory without restriction, leading to denial of service conditions. The internal web server is disabled by default, which mitigates the risk unless explicitly enabled by the user. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability.

Successful exploitation results in denial of service by exhausting memory resources on the affected system running PowerDNS Recursor. There is no impact on confidentiality or integrity. The internal web server being disabled by default limits the attack surface. No known exploits are reported in the wild at this time.

No official patch or fix has been published yet. Since the internal web server is disabled by default, ensure it remains disabled unless necessary. Monitor vendor advisories for updates or patches. Avoid enabling the internal web server unless required and consider network-level controls to restrict access if it must be enabled. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.