CVE-2023-26437: 
Linux Debian vulnerability analysis and mitigation

A denial of service vulnerability was discovered in PowerDNS Recursor that allows authoritative servers to be marked unavailable. This vulnerability affects PowerDNS Recursor versions through 4.6.5, through 4.7.4, and through 4.8.3. The issue was disclosed on March 29, 2023, and was assigned CVE-2023-26437 (PowerDNS Advisory).

The vulnerability occurs when the recursor detects and deters a spoofing attempt or receives certain malformed DNS packets. In such cases, it throttles the server that was the target of the impersonation attempt to prioritize other authoritative servers for the same zone. The vulnerability has been assigned a CVSS 3.1 base score of 5.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

An attacker with the ability to send queries to the recursor and guess the correct source port of the corresponding outgoing query can inject packets with a spoofed IP address. This can force the recursor to mark specific authoritative servers as unavailable, leading to a denial of service for the zones served by those servers (PowerDNS Advisory).

The vulnerability has been fixed in PowerDNS Recursor versions 4.6.6, 4.7.5, and 4.8.4. Users are advised to upgrade to these patched versions to mitigate the vulnerability (PowerDNS Advisory).