PowerDNS Recursor CVE-2026-85558

The Recursor must accept DNS-over-TCP client connections (a standard, on-by-default capability for DNS resolvers handling truncated/large responses and zone operations). The defect causes the data structure tracking client addresses to retain entries for connections that have already closed, and this state is only freed when the process exits. Limiting factors: the impact is cumulative rather than instantaneous - a single connection is harmless, and meaningful memory pressure requires a high volume of TCP connect/close cycles accumulated over long process uptime; there is no authentication bypass, data exposure, or code execution, and operators who restart Recursor regularly (or run it behind connection-limiting front ends) materially reduce exposure. Authentication requirements are not confirmed from available data as no CVSS vector was provided, but TCP DNS service is typically reachable by any client permitted to query the resolver.

No CVSS vector, EPSS score, KEV listing, or public POC is present in the provided data, so quantitative exploitation signals are entirely absent and the assessment rests on the vendor advisory text alone. CVE-2026-85558 is described as 'Recursor retains closed TCP client addresses until process exit,' which is a resource/memory leak rather than a code-execution or data-disclosure flaw; the parent PowerDNS Advisory 2026-12 explicitly classifies three of its CVEs as High and the remainder (which includes this one by position) as Medium or Low, indicating the vendor itself treats this as a lower-tier availability issue. Real-world risk is therefore a gradual availability degradation: an attacker or even normal heavy TCP traffic causes unbounded growth of retained client-address state, which over long uptimes can exhaust memory and force a restart. This is a genuine hardening/operational concern for high-traffic resolvers but not an urgent emergency - there is no public exploit identified at time of analysis, no evidence of active exploitation, and the impact is throttled by requiring sustained connection volume over time rather than a single packet. Severity banding (Medium/Low) is inferred from the advisory's grouping language, not independently confirmed per-CVE, and should be verified against the full advisory at the referenced URL.

An attacker (or a busy production environment) opens and closes large numbers of DNS-over-TCP connections to a PowerDNS Recursor instance; because the resolver fails to release the client-address state for closed connections, memory consumption grows steadily and is never reclaimed until the process exits. Over sustained operation this can degrade performance or exhaust memory, requiring an administrative restart. No public exploit code is identified at time of analysis.