Improper control of a resource through its lifetime in PowerDNS Recursor - CVE-2026-73205
Published: October 21, 2026
Vulnerability identifier: #VU156685
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73205
CWE-ID: CWE-664
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by preventing PowerDNS Recursor from opening new outgoing TCP connections.
The vulnerability exists due to improper resource lifecycle management in outgoing TCP connection handling when closed connections retain operating system resources in the TIME_WAIT state. A remote attacker can induce excessive numbers of these connections to exhaust available resources and prevent new connections to authoritative servers.
Affected software
PowerDNS Recursor
How to mitigate CVE-2026-73205
Install security update from vendor's website.
PowerDNS Recursor - addressed in versions 5.3.12, 5.4.8