PowerDNS Recursor CVE-2026-42387

The ZoneToCache function must be invoked, meaning the Recursor must actively process zone data from an authoritative server - this occurs during recursive resolution when the Recursor queries an authoritative server for a name within the crafted zone. The attacker must control or compromise an authoritative DNS server that the target Recursor will query, either by owning a domain whose delegation reaches the malicious server or by hijacking an existing authoritative server. The CVSS AC:H metric confirms this non-trivial positional requirement. Exploitation is limited to availability impact only - there is no path to code execution or data exfiltration. Deployments that do not expose the Recursor to arbitrary authoritative servers (e.g., internal-only resolvers that never query external DNS) face significantly reduced risk.

The CVSS base score of 5.9 (Medium) reflects a meaningful but constrained threat. The AC:H metric is the key limiting factor: the attacker must control or successfully impersonate an authoritative DNS server that the targeted Recursor queries, which is not a trivial precondition. Impact is solely on availability (A:H), with no confidentiality or integrity exposure. No EPSS data was provided, and there is no CISA KEV listing, suggesting exploitation has not been observed at scale. No public proof-of-concept is known. For organizations that rely on PowerDNS Recursor as their primary DNS resolver, a crash means complete DNS resolution failure for all downstream clients, which can cascade into broad service outages. The realistic threat actor is one with the ability to register or compromise a domain's authoritative server - feasible for targeted attacks against specific organizations whose DNS resolution path can be influenced. This is not a spray-and-pray vulnerability; it requires meaningful attacker investment.

An attacker who controls a registered domain's authoritative name server crafts a zone with malformed data designed to trigger the crash condition in ZoneToCache. When the PowerDNS Recursor resolves a query for a name under that domain, it contacts the malicious authoritative server, receives the crafted zone, and crashes - taking DNS resolution offline for all clients depending on that Recursor instance. No public proof-of-concept code is known, but the attack surface (any domain the attacker controls) makes the precondition achievable for a motivated threat actor.