The vulnerability CVE-2026-42387 in PowerDNS Recursor arises from improper input validation in the ZoneToCache function. A malicious authoritative DNS server can exploit this by sending a crafted DNS zone that causes the Recursor to crash, leading to denial of service. The CVSS 3.1 base score is 5.9, reflecting a network attack vector with high attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service). Affected versions include exact versions 5.2.0, 5.3.0, 5.4.0, and version ranges >=5.2.0 <5.2.11, >=5.3.0 <5.3.8, and >=5.4.0 <5.4.3. No vendor advisory or patch information is provided, and the remediation level is unknown.

Successful exploitation causes the PowerDNS Recursor to crash, resulting in denial of service. There is no impact on confidentiality or integrity reported. The attack can be launched remotely without authentication or user interaction, but requires a malicious authoritative DNS server to send crafted data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure to untrusted authoritative DNS servers or implementing network-level controls to detect and block suspicious DNS zone transfers targeting the Recursor.