A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondary server forwards a DNS update request to it.
https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-05.html