This vulnerability involves the improper caching of ECS (EDNS Client Subnet) zero scoped answers in PowerDNS Recursor. Normally, ECS zero scoped answers should not be stored in the packet cache, but due to this flaw, they are cached, potentially exposing DNS resource data to queries outside their intended scope. The issue affects only configurations where ECS is enabled. The affected versions include 5.2.0, 5.3.0, 5.4.0, and all versions from 5.2.0 up to but not including 5.2.11, from 5.3.0 up to but not including 5.3.8, and from 5.4.0 up to but not including 5.4.3. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability may lead to unintended exposure of DNS resource data due to caching ECS zero scoped answers improperly. This could allow DNS responses to be served in incorrect query contexts, potentially leaking information about DNS queries or responses. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor PowerDNS advisories for updates. In the meantime, consider disabling ECS if feasible to avoid exposure from this vulnerability.