This vulnerability involves allocation of resources without limits or throttling in the internal web server component of PowerDNS Authoritative. An unauthenticated attacker can send crafted web requests that cause the server to allocate memory without restriction, leading to denial of service conditions. The internal web server is not enabled by default, which mitigates exposure. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with no privileges or user interaction required, and impact limited to availability.

Successful exploitation results in denial of service by exhausting memory resources on the affected PowerDNS Authoritative server. There is no impact on confidentiality or integrity. Since the internal web server is disabled by default, the attack surface is limited unless the feature is explicitly enabled by an administrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure the internal web server feature is disabled if not required, as it is off by default. Monitor vendor communications for updates on patches or official mitigations.