CVE-2026-85557: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-85557 is a denial-of-service vulnerability in PowerDNS Recursor where a single web client that does not complete the TLS handshake can monopolize web access, effectively blocking all other clients from accessing the web interface. The CVE was inserted into Feedly's threat intelligence feed on October 21, 2026, with an associated PowerDNS security advisory published the same day. The affected product is PowerDNS Recursor (vendor: powerdns). The CVE status is currently listed as "Reserved," and no CVSS score has been publicly assigned at this time (PowerDNS Advisory, oss-sec).

The vulnerability stems from improper handling of incomplete TLS handshakes in PowerDNS Recursor's built-in web server. When a client initiates but does not complete a TLS handshake, the server holds the connection open, consuming a resource slot. Because the web server does not enforce a timeout or connection limit per client for this scenario, a single malicious or malfunctioning client can exhaust available connection slots, preventing legitimate clients from accessing the web interface. This is consistent with CWE-400 (Uncontrolled Resource Consumption) or CWE-772 (Missing Release of Resource after Effective Lifetime) (PowerDNS Advisory, oss-sec).

Successful exploitation results in a denial-of-service condition against the PowerDNS Recursor web interface, preventing administrators and monitoring systems from accessing the management or metrics endpoint. The DNS resolution functionality itself may remain unaffected, but loss of web access can impair operational visibility, configuration management, and integration with monitoring tools. The impact is primarily an availability concern for the web management plane rather than a full DNS outage (PowerDNS Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The attack requires network access to the PowerDNS Recursor web interface and the ability to initiate but intentionally stall a TLS handshake, which is a low-complexity technique achievable with standard networking tools. No EPSS score or CISA KEV catalog entry has been reported for this CVE (PowerDNS Advisory, oss-sec).

1. Reconnaissance: Identify hosts running PowerDNS Recursor with the web interface enabled and accessible over the network (default port is typically 8082).
2. Initiate TLS handshake: Using a tool such as openssl s_client or a custom script, connect to the PowerDNS Recursor web interface port and begin a TLS handshake.
3. Stall the handshake: Do not send the ClientHello completion or subsequent handshake messages, leaving the connection in a pending/incomplete state.
4. Repeat to exhaust connections: Open additional stalled TLS connections (potentially from the same client) until all available web server connection slots are consumed.
5. Monopolize web access: With all slots occupied by incomplete handshakes, legitimate clients attempting to connect to the web interface will be refused or time out, achieving denial of service against the management plane (PowerDNS Advisory).

• Network: High number of TCP connections to the PowerDNS Recursor web interface port (e.g., 8082) from one or few source IPs that remain in a TLS handshake state (SYN_RECV or ESTABLISHED without data exchange); connections persisting without completing the handshake for an abnormal duration.
• Logs: PowerDNS Recursor web server logs showing repeated connection attempts from a single IP with no successful TLS completion; error messages indicating web interface unavailability or connection slot exhaustion.
• Process: Elevated number of open file descriptors or socket handles associated with the recursor process without corresponding completed sessions.

Administrators should apply the patched version of PowerDNS Recursor referenced in the official security advisory (PowerDNS Security Advisory 2026-12). As a workaround prior to patching, restrict access to the PowerDNS Recursor web interface using firewall rules or ACLs to trusted IP addresses only, reducing the attack surface. Additionally, consider placing the web interface behind a reverse proxy that enforces TLS handshake timeouts (PowerDNS Advisory, oss-sec).

The vulnerability was disclosed via the PowerDNS blog and the oss-security mailing list on October 21, 2026. No notable independent researcher commentary or significant social media discussion has been identified beyond the initial disclosure (PowerDNS Advisory, oss-sec).