PowerDNS Recursor CVE-2026-85557

Requires network reachability to the PowerDNS Recursor built-in webserver/REST API (the TLS/HTTPS-enabled web endpoint); exploitation consists of initiating but never completing a TLS handshake to that service, monopolizing the single web handler. Limiting factors: the Recursor webserver is disabled or bound to 127.0.0.1 by default and is normally restricted to trusted management networks, so an attacker must have access to the administrative interface; impact is confined to the web/API interface and does not interrupt DNS resolution, cache integrity, or DNSSEC validation. No authentication appears necessary to begin the TLS handshake, but authentication requirements are not confirmed from available data since no CVSS vector was published.

No CVSS vector, EPSS score, KEV listing, or POC is provided for CVE-2026-85557, so this assessment relies on the vendor advisory text alone. PowerDNS Security Advisory 2026-12 explicitly states that three of its CVEs are rated High and the remainder (which includes this one) are Medium or Low; this issue - 'Single web client not doing TLS handshake monopolizes web access' - is a resource-monopolization denial-of-service affecting only the Recursor's built-in webserver/API, not the core DNS resolution path. The real-world priority is modest: it does not compromise confidentiality or integrity, does not poison the cache, and does not affect DNS answers served to clients. The practical risk is further bounded by the fact that the PowerDNS Recursor webserver binds to 127.0.0.1 by default and is typically restricted to trusted management networks, so an attacker needs reachability to that administrative interface. There is no evidence of active exploitation and no public exploit code identified. Net: a legitimate availability bug worth patching during normal maintenance, not an emergency - closer to a 'medium/low severity, low real-world risk' issue than a high-priority threat. Note the absence of a vendor-published CVSS vector means attack-vector and privilege details below are inferred from the advisory title and PowerDNS defaults, not confirmed by NVD.

An attacker able to reach the Recursor's HTTPS webserver/API endpoint opens a TLS connection but deliberately never completes the handshake, holding the single-threaded web handler and blocking all other administrators and monitoring tools from accessing the web interface or API. No public exploit code is identified, but the technique is a well-understood slow-handshake/slowloris pattern requiring only a single stalled connection.