PowerDNS Recursor CVE-2026-73206

Exploitation requires the attacker to get a crafted DNS packet with malicious name-compression pointers processed by the PowerDNS Recursor - either by sending it directly to a reachable recursor service port or by inducing the recursor to resolve a name served by an attacker-controlled authoritative server, which then returns the malicious packet. The primary limiting factor is network reachability of the recursor: recursors restricted to trusted internal clients (the recommended default for PowerDNS Recursor, which is not meant to be internet-facing as an open resolver) are far less exposed, whereas open or widely reachable resolvers are directly at risk. No authentication or user interaction is implied by the description, but authentication requirements are not confirmed from available data because no CVSS vector was provided.

No CVSS vector, EPSS score, KEV listing, or POC is present in the provided data, so quantitative exploitation signals are entirely absent and the assessment rests on the vendor advisory text alone. PowerDNS classifies Advisory 2026-12 as containing three High-severity and several Medium/Low CVEs but does not map each CVE to a severity in the supplied material; a crafted-packet denial of service of this nature is consistent with one of the High ratings, though this is inferred, not confirmed. The vulnerability is a denial of service triggered by decompressing DNS names in a crafted packet - a classic resource-exhaustion/crash primitive against a network-facing daemon, which typically means remote, unauthenticated reachability but no confidentiality or integrity impact. Because this is availability-only against a DNS resolver rather than a code-execution flaw, real-world priority is moderate-to-high for operators of exposed recursors (DNS outages cascade) but it is not a compromise vector; absent EPSS/KEV data there is no evidence of active exploitation. Key signals are missing or conflicting: no official CVSS vector is published in this feed, so attack complexity and privilege requirements are my own assessment and should be verified against the full PowerDNS advisory (reference 3).

A remote attacker sends (or causes a recursor to fetch from an attacker-controlled authoritative server) a specially crafted DNS packet whose compressed name pointers force expensive or looping decompression, exhausting CPU/resources and degrading or crashing the PowerDNS Recursor. A successful trigger denies DNS resolution to all downstream clients of that resolver. No public exploit code is identified in the provided data.