PowerDNS Recursor CVE-2026-73205

Exploitation requires that the Recursor accept DNS over TCP from the attacking client (TCP service reachable, which is standard DNS behavior for truncated/large responses and zone operations). No authentication and no special PowerDNS feature flag is called out in the advisory. The limiting factor is that impact is confined to availability via TCP socket/TIME_WAIT exhaustion - it does not affect UDP query service directly, does not compromise DNS data integrity, and severity is rated Medium/Low rather than High; a client able to establish repeated TCP connections to the resolver is the only real prerequisite, so exposure is highest where the resolver's TCP port is reachable by untrusted networks rather than restricted to trusted internal clients.

No CVSS vector, EPSS score, KEV listing, or SSVC decision data was supplied for this CVE, so the assessment rests entirely on the PowerDNS advisory text and release notes. The advisory explicitly states that three of the bundled CVEs are High severity and the rest are Medium or Low; CVE-2026-73205 (a malicious client causing excessive TCP connections in TIME_WAIT state) is a resource-exhaustion/denial-of-service condition that falls in the Medium/Low tier rather than the High group. This is therefore a genuine availability concern but not a top-priority emergency: the impact is degraded TCP handling (socket/port exhaustion) rather than code execution, data disclosure, or DNS integrity loss. There is no public exploit identified at time of analysis and no evidence of active exploitation, so the real-world urgency is moderate - patch in the normal cycle. Note that exact severity is INFERRED from the advisory's High-vs-Medium/Low grouping, not confirmed by an NVD/vendor CVSS score, which was listed as N/A in the input; defenders should confirm the per-CVE score against the full PowerDNS advisory 2026-12 once published.

A malicious or abusive client repeatedly opens and tears down TCP connections to a PowerDNS Recursor, driving a large and sustained number of sockets into the TIME_WAIT state. As TIME_WAIT entries and ephemeral ports/socket table accumulate, the resolver's ability to accept new TCP DNS connections degrades, producing a denial of service for legitimate clients. No public exploit code is identified at time of analysis, but the technique requires only ordinary TCP client behavior and no special privileges.