PowerDNS Authoritative versions 4.9.0 and 5.0.0 contain a vulnerability identified as CVE-2026-42001, characterized by insufficient validation of autoprimary SOA queries. This weakness allows an attacker to cause uncontrolled resource consumption, impacting the availability of the DNS service. The vulnerability is remotely exploitable without authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). No integrity or confidentiality impact is noted. As of the published date, no patch or official remediation level has been provided by the vendor.

The vulnerability can cause denial of service by exhausting resources on affected PowerDNS Authoritative servers, leading to service disruption. There is no impact on data confidentiality or integrity. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider limiting exposure of affected PowerDNS Authoritative instances to untrusted networks and monitor for unusual query patterns related to autoprimary SOA requests.