An issue has been found in PowerDNS Recursor before 4.1.18 4.2.x before 4.2.5 and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state instead of their actual DNSSEC Secure state via a DNS ANY query. This results in a denial of service for installation that always validate (dnssec=validate) and for clients requesting validation when on-demand validation is enabled (dnssec=process).