This vulnerability in PowerDNS Recursor involves insufficient verification of data authenticity due to RRSIG records containing too few labels. This condition enables an attacker to bypass DNSSEC wildcard validation, undermining the DNSSEC security guarantees. The affected versions include 5.2.0, 5.3.0, 5.4.0, and all versions from 5.2.0 up to but not including 5.2.12, 5.3.0 up to but not including 5.3.9, and 5.4.0 up to but not including 5.4.4. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable over the network without privileges or user interaction, impacting integrity but not confidentiality or availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

The vulnerability allows attackers to bypass DNSSEC wildcard validation, which can lead to integrity violations in DNS responses. This undermines the trust model of DNSSEC, potentially allowing forged DNS responses to be accepted as valid. There is no impact on confidentiality or availability according to the CVSS vector. The vulnerability is exploitable remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor vendor communications for updates. No specific temporary mitigations are documented at this time.