This vulnerability in PowerDNS DNSdist involves a missing release of resources after their effective lifetime when processing IXFR queries. Specifically, outgoing TCP connections to backend servers may not be released immediately and instead remain stuck until a timeout occurs. This can cause denial of service by exhausting the number of concurrent connections or available file descriptors. The affected versions include 1.9.0, 2.0.0, and all versions from 1.9.0 up to but not including 1.9.15, and from 2.0.0 up to but not including 2.0.7. The CVSS 3.1 base score is 5.3, indicating medium severity with no confidentiality or integrity impact but with availability impact. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability can cause denial of service by causing outgoing TCP connections to backend servers to remain stuck until timeout, potentially exhausting connection limits or file descriptors. There is no impact on confidentiality or integrity. The availability of the DNSdist service may be degraded or interrupted under attack conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure to untrusted IXFR queries or monitoring backend connection usage to detect potential exhaustion. No official fix or workaround is currently documented.