PowerDNS Recursor Denial-of-Service Vulnerability via TCP NOTIFY Queries

A denial-of-service vulnerability has been identified in PowerDNS Recursor versions up to and including 5.3.2, 5.2.6, and 5.1.8. The issue arises from insufficient validation of incoming NOTIFY queries over TCP, allowing an attacker to clear cached records, which can disrupt normal DNS resolution processes.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition by allowing the removal of cached DNS records, potentially causing increased latency or failure in DNS resolution.

Remediation

Users can upgrade to PowerDNS Recursor versions 5.3.3, 5.2.7, or 5.1.9, or configure their server to prevent incoming NOTIFY queries over TCP.