Hickory DNS EUVD-2026-119335

Exploitation requires the target to be running the Hickory DNS DNS-over-QUIC (DoQ) server, which is the specific feature path where buffers are pre-allocated on a length prefix with no timeout for completing the request body; servers not exposing DoQ are not affected. Within that mode the CVSS vector confirms remote, unauthenticated exploitation (AV:N/PR:N/UI:N/AC:L/AT:N) with no special preconditions beyond network reachability of the DoQ listener - the attacker simply opens many connections and sends oversized length prefixes without bodies. The primary limiting factor is deployment-dependent: whether DoQ is enabled and reachable. Impact is denial of service only (resource/memory exhaustion); there is no code execution, data disclosure, or integrity loss. No patched release is available, so the only present limit is configuration exposure, not an upstream fix.

This is a genuine availability-only risk whose priority is moderate-to-high but narrower than the 8.7 CVSS 4.0 base score suggests in isolation. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no attack requirement, and the impact is confined to availability (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, consistent with the CWE-770 missing-resource-limits root cause described in the GHSA advisory. Supporting signals are thin and should be stated plainly: no EPSS score was supplied, the vulnerability is NOT on CISA KEV, and no public exploit or PoC code is referenced (only a GHSA and a VulnCheck advisory, which are descriptive write-ups, not working exploits). The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a real but non-emergency DoS. The most important limiting factor NOT visible in the CVSS vector is that the flaw only exists in the DNS-over-QUIC server path, so deployments that do not enable DoQ are unaffected - verify this against your configuration before prioritizing. Weigh against this that no fix is yet available, which raises urgency for exposed DoQ operators since there is no patch to deploy.

A remote, unauthenticated attacker opens a large number of DNS-over-QUIC connections to a Hickory DNS server and, on each, sends only a large length prefix without ever delivering the full request body. Because the server pre-allocates a buffer on the prefix and has no timeout to reclaim it, memory accumulates across the stalled connections until the server is exhausted. No public exploit code is identified at time of analysis; the attack is low-complexity (AC:L) and requires no authentication or user interaction.