Hickory DNS EUVD-2026-119334

Exploitation requires that the target run Hickory DNS (< 0.26.2) with its DNS-over-HTTPS HTTP/2 server enabled and network-reachable to the attacker; the DoH listener is the specific feature that must be exposed. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) this is remote and unauthenticated with no user interaction against that endpoint. The limiting factor is deployment-dependent: only instances that actually serve DoH are affected, and operators who front the server with reverse-proxy connection/timeout limits or restrict access to the DoH port materially reduce exposure. The complete fix is upgrading to 0.26.2.

This is a genuine, moderately prioritized availability risk rather than a critical emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remote, unauthenticated, low-complexity attack requiring no user interaction, with impact confined to availability (VA:H; VC:N/VI:N - no confidentiality or integrity impact), consistent with a CWE-770 resource-exhaustion denial of service. The vuln.today priority is 'this_week' (not act_now/emergency), which aligns with a serious-but-not-crisis DoS. No EPSS score, no CISA KEV listing, and no confirmed exploit code are present in the input, so there is no signal of active exploitation; exploitation status is best described as no public exploit identified at time of analysis, with two advisory references (GHSA and VulnCheck) that describe the flaw but are not verified working exploit code. The signals are internally consistent: a high CVSS (8.7) driven entirely by availability on a network-reachable service, tempered by the absence of exploitation-probability data. The main caveat is that the DoS is slow/holding-connection style memory exhaustion whose real-world impact depends on how exposed the DoH endpoint is and what connection limits the operator has in place.

A remote, unauthenticated attacker opens many DNS-over-HTTPS connections to a Hickory DNS server's HTTP/2 DoH endpoint, begins sending request bodies but never completes them, and keeps the connections open. Because the server lacks sufficient timeouts or limits on incomplete request bodies, each held connection accumulates memory until the server is exhausted and denied to legitimate clients. No exploit code is confirmed available; the two listed references are advisories, not verified working exploits.