This vulnerability involves uncontrolled allocation of resources (memory) in the internal web server component of PowerDNS Authoritative. An attacker can send crafted web requests that cause the server to allocate memory without limits or throttling, leading to denial of service conditions. The internal web server is disabled by default, which mitigates exposure unless explicitly enabled. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with no privileges or user interaction required, causing availability impact only. No official fix or patch has been announced as of the published date.

Successful exploitation results in denial of service due to excessive memory consumption in the internal web server. This impacts availability but does not affect confidentiality or integrity. Since the internal web server is disabled by default, the risk is limited to environments where it is enabled. There are no known exploits in the wild at this time.

As there is no official patch or remediation level available, users should ensure the internal web server is disabled unless explicitly required. Avoid enabling the internal web server to reduce exposure. Monitor vendor advisories for updates or patches addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.