An unauthenticated remote attacker can inject invalid configuration data into the PowerDNS Authoritative backend, causing a persistent denial of service that requires manual recovery.

This flaw involves improper control of configuration generation, where an unauthenticated attacker sends a malicious notify request to add a secondary domain, resulting in a corrupted backend configuration.

The vulnerability carries a CVSS score of 7.4, reflecting a high risk to service availability. Successful exploitation renders the DNS server unable to restart after a failure, which can lead to extended periods of downtime for critical network infrastructure and loss of service for dependent applications.

Immediate Action: Upgrade PowerDNS Authoritative to version 5.0.4 or 4.9.14 immediately to resolve the configuration injection vulnerability.

Proactive Monitoring: Monitor server logs for unexpected notify requests or errors related to domain additions that do not align with established provisioning workflows.

Compensating Controls: Implement strict network access control lists to restrict which IP addresses are permitted to send notify requests to the Authoritative server.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate attention to prevent potential service outages. Administrators should prioritize patching the PowerDNS Authoritative software to the provided fixed versions, as this is the only reliable way to prevent the injection of invalid configuration data. Until the patch is applied, limit exposure by restricting network access to the server.