This vulnerability in PowerDNS Recursor involves a use-after-free condition triggered by multiple concurrent transfers of the same RPZ zone. The flaw can lead to inconsistent RPZ data or cause the recursor to crash. Concurrent transfers of the same RPZ zone are not expected under normal operation and usually indicate a malfunctioning RPZ provider. The affected versions are 5.2.0, 5.3.0, and 5.4.0. The CVSS 3.1 base score is 5.0, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges. No official remediation or patch has been documented at this time.

The vulnerability can cause inconsistent RPZ data and potentially crash the PowerDNS Recursor service due to use-after-free conditions. There is no indication of confidentiality or integrity compromise, but availability may be impacted. Exploitation requires high privileges and has high attack complexity, reducing the likelihood of widespread exploitation. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor RPZ provider behavior to avoid malfunctioning concurrent RPZ transfers. No specific vendor mitigation or workaround has been published.