This vulnerability in PowerDNS Recursor allows an attacker to cause a denial of service by sending replies that trigger a null pointer dereference. The root cause is a missing consistency check in the code handling replies. The issue affects versions 5.2.0 through 5.4.0. The CVSS 3.1 base score is 5.9, reflecting a network attack vector with high attack complexity, no privileges required, no user interaction, and impact limited to availability. No known exploits are reported in the wild, and no vendor advisory or patch links are currently available.

Successful exploitation causes a denial of service by crashing or destabilizing the PowerDNS Recursor process due to null pointer dereference. There is no confidentiality or integrity impact reported. The denial of service could disrupt DNS resolution services relying on the affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the affected PowerDNS Recursor instances to untrusted networks and monitor for unusual crashes or service interruptions. Since cookies are disabled by default, no mitigation related to cookie handling is necessary.