This vulnerability in PowerDNS Recursor allows an attacker controlling a malicious authoritative DNS server to send specially crafted zone data through the ZoneToCache function. This crafted data can cause the DNS cache to be poisoned, potentially leading to incorrect DNS responses being served to clients. The vulnerability affects versions 5.2.0, 5.3.0, 5.4.0, and all versions from 5.2.0 up to but not including 5.2.11, 5.3.0 up to but not including 5.3.8, and 5.4.0 up to but not including 5.4.3. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, scope changed, no confidentiality impact, high integrity impact, and low availability impact.

Successful exploitation can lead to cache poisoning in the PowerDNS Recursor, which compromises the integrity of DNS responses. This can cause clients to receive incorrect DNS information, potentially redirecting them to malicious sites or disrupting normal DNS resolution. There is no confidentiality impact, and availability impact is low according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or monitoring communications with untrusted authoritative DNS servers to reduce exposure. Avoid relying on affected versions in untrusted environments.