PowerDNS -- Multiple vulnerabilities

PowerDNS reports:

• CVE-2026-73206: A crafted DNS packet can cause a denial of service decompressing the DNS names in the packet
• CVE-2026-73205: A malicious client can cause too many TCP connections in TIME_WAIT state
• CVE-2026-85555: DNSSEC validation bypass and cache poisoning in PowerDNS Recursor via out-of-band NS resolution
• CVE-2026-85556: Missing OPT RR owner-name validation bypasses ECS hardening
• CVE-2026-85557: Single web client not doing TLS handshake monopolizes web access
• CVE-2026-85558: Recursor retains closed TCP client addresses until process exit
• CVE-2026-85559: Out-of-bounds read in Recursor findScopeZero

[source]