PowerDNS Recursor CVE-2026-42388

Exploitation requires that the target PowerDNS Recursor is configured to consume catalog zones - a non-default zone management feature that must be explicitly enabled and pointed at an authoritative catalog zone server. The attacker must further control or compromise an authoritative name server that the Recursor trusts as a catalog zone source, or otherwise be able to inject a catalog zone containing a malformed SOA record into the Recursor's zone processing pipeline. Standard Recursor deployments not using catalog zones are not affected. Exploitation is limited by: the non-default catalog zone configuration requirement (reflected in AC:H), the need for influence over a trusted authoritative zone source, and the purely availability-focused impact with no opportunity for data exfiltration or code execution.

The CVSS 5.9 Medium score is appropriate for this flaw. The network attack vector with no privilege requirement indicates broad theoretical reachability, but high attack complexity (AC:H) limits practical exploitability to deployments where catalog zones are actively configured - a non-default feature. Impact is confined entirely to availability (A:H): a successful attack crashes the Recursor, halting DNS resolution, but yields no confidentiality or integrity gain for the attacker. No EPSS score is available in the provided data, so exploitation probability cannot be quantitatively assessed. The vulnerability is not in the CISA KEV catalog and no POC has been reported, supporting a lower urgency classification for most operators. However, for DNS infrastructure serving critical environments, even a medium-severity DoS warrants prompt patching given that DNS unavailability cascades into broad service outages. The primary risk-limiting factor is the catalog zone configuration prerequisite, meaning the realistic exposed population is a subset of all PowerDNS Recursor deployments.

An attacker who operates or compromises an authoritative DNS server configured as a catalog zone source for a target PowerDNS Recursor instance crafts a zone containing a malformed or minimally incomplete SOA record. When the Recursor fetches and processes the catalog zone - either on schedule or triggered by a NOTIFY - the incomplete SOA validation logic crashes the Recursor process, immediately halting recursive DNS resolution for all clients depending on that instance. No public exploit identified at time of analysis.