This vulnerability in PowerDNS Recursor arises from a missing consistency check in the zoneToCache function. When an attacker controls an authoritative DNS server and sends a specially crafted zone, it can cause the software to dereference a NULL pointer, leading to a denial of service condition. The affected versions are 5.2.0, 5.3.0, and 5.4.0. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges. The vulnerability does not impact confidentiality or integrity but affects availability.

Successful exploitation results in a denial of service by crashing the PowerDNS Recursor process. There is no impact on confidentiality or integrity. The attack requires high privileges and a complex attack vector, limiting the ease of exploitation. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to authoritative servers or monitoring for unusual DNS responses that could trigger this condition. Avoid using affected versions if possible and stay updated with PowerDNS advisories for patches.