CVE-2026-85558: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-85558 is a resource management vulnerability in PowerDNS Recursor where closed TCP client addresses are retained in memory until process exit, potentially impacting resource utilization and availability. The CVE is currently in "Reserved" status, indicating it is in early disclosure stages. The affected product is PowerDNS Recursor (specific version ranges not yet publicly confirmed). It was inserted into Feedly's threat intelligence feed on October 21, 2026, with references to a PowerDNS security advisory and an oss-security mailing list post (PowerDNS Blog, oss-sec). No CVSS score has been publicly assigned at this time.

The root cause of CVE-2026-85558 is improper resource release after the end of a TCP client connection's lifecycle — classifiable under CWE-772 (Missing Release of Resource after Effective Lifetime). PowerDNS Recursor fails to free or discard TCP client address entries when connections are closed, causing these entries to accumulate in memory until the process is restarted. This behavior can be triggered by any client capable of establishing and closing TCP connections to the resolver, requiring no authentication or special privileges. No public technical write-ups or proof-of-concept code have been identified beyond the initial advisory references (PowerDNS Blog, oss-sec).

The primary impact of this vulnerability is on availability: an attacker or high-volume client traffic could cause PowerDNS Recursor to accumulate stale TCP client address entries, leading to excessive memory consumption and potential denial of service. Confidentiality and integrity are not directly affected, as the issue is limited to resource management rather than data exposure or unauthorized modification. In high-traffic environments, this memory leak could degrade resolver performance or cause process crashes, disrupting DNS resolution for all dependent systems (PowerDNS Blog).

There is no evidence of in-the-wild exploitation, no public proof-of-concept code, and no known exploit kits associated with CVE-2026-85558 at this time. The CVE remains in "Reserved" status, and no EPSS score or CISA KEV catalog entry has been identified. The attack surface is limited to systems running PowerDNS Recursor that accept TCP DNS connections, which is a common configuration (PowerDNS Blog, oss-sec).

Administrators should consult the PowerDNS Security Advisory 2026-12 for patched version information and apply any available updates to PowerDNS Recursor as soon as they are released (PowerDNS Blog). As a temporary workaround, periodically restarting the PowerDNS Recursor process can flush accumulated stale TCP client address entries and reclaim memory. Network-level controls such as rate-limiting TCP DNS connections from untrusted sources may reduce the risk of resource exhaustion in the interim.

The vulnerability was disclosed via the PowerDNS blog and the oss-security mailing list on October 21, 2026, following standard coordinated disclosure practices (PowerDNS Blog, oss-sec). No notable researcher commentary, broader media coverage, or significant community discussion has been identified beyond these initial disclosure channels at this time.