It was found [1] that in default configuration PowerDNS is allowed to
consume more file descriptors than is available for a default installation
of many Linux distributions.
Default configuration is: 2 threads / 2048 max-mthreads, which leads
to a theoretical FD consumption of 4096. Default FD limit on many
distributions is 1024.
This can potentially lead to the DoS attack.

Workaround (from [1]):

- Reduce max-mthreads to 512 (or threads to 1 and max-mthreads to
1024) (max-mthreads was introduced in Recursor 3.2; but if you are
running a version that old, please upgrade it!)
- Run ‘ulimit -n 32768′ before starting (perhaps put this in
/etc/init.d/ script). There’s little reason to skip on this number.
- Investigate defaults in /etc/security/limits.conf

Patch is available at [2]

[1]: http://blog.powerdns.com/2014/02/06/related-to-recent-dos-attacks-recursor-configuration-file-guidance/
[2]: https://github.com/Habbie/pdns/commit/e24b124a4c7b49f38ff8bcf6926cd69077d16ad8

References:

https://bugs.mageia.org/show_bug.cgi?id=13521
https://bugzilla.redhat.com/show_bug.cgi?id=1109231