This vulnerability involves improper encoding or escaping of output in the prometheus endpoint of PowerDNS DNSdist. An attacker can send many specially crafted DNS queries that trigger a dynamic block insertion with values that produce invalid output in the prometheus metrics endpoint. Consequently, the prometheus scraper will reject the endpoint until the dynamic block expires, potentially disrupting monitoring data collection. The CVSS score is 3.7 (low severity) with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The impact is limited to causing the prometheus metrics endpoint to produce invalid output, which leads to the prometheus scraper rejecting the endpoint temporarily. This may disrupt monitoring but does not affect confidentiality or availability of the DNS service itself. There is no indication of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitoring the prometheus endpoint for invalid output and limiting exposure of the DNSdist prometheus endpoint to trusted scrapers may reduce risk.