Hickory DNS EUVD-2026-119345

Exploitation requires the attacker to control two DNS zones whose name servers are cyclic sibling references into each other's zones AND that omit the required glue (A/AAAA) records for those name servers (RFC 9471 section 2.3), so that at least one zone that should supply name-server addresses does not - making the delegation unresolvable and forcing the recursor into repeated lookups. The victim must run the Hickory recursive resolver (hickory-recursor 0.25.0-alpha.3 through 0.25.2, or hickory-resolver 0.26.0-alpha.1 up to the 0.26.2 fix) and be made to resolve a name under those attacker zones. Amplification is maximized when the referral NS records carry a TTL of zero, defeating caching and multiplying upstream queries. LIMITING FACTORS: although the CVSS vector is PR:N/UI:N (no authentication or victim interaction), the attacker must first set up and host the malicious cyclic zones, and impact is confined to availability/resource consumption (VC:N/VI:N) - there is no confidentiality or integrity effect. The hickory-recursor branch has no fixed version available yet, so operators of that crate cannot simply upgrade.

This is a genuine but bounded availability risk, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VA:H and VC:N/VI:N describes a pure availability (denial-of-service / resource-exhaustion, CWE-400/406/674) issue reachable over the network without authentication or user interaction, which drives the 8.7 score. However, the described mechanism imposes a real precondition the CVSS vector does not capture: the attacker must control two DNS zones configured with cyclic sibling name-server referrals lacking glue records, so exploitation is attacker-setup-dependent rather than a flaw triggerable against an arbitrary target with a single packet. The vuln.today decision label is 'this_week' (not act_now/emergency). No EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the input - exploitation status is therefore 'no public exploit identified at time of analysis'. Net: a credible, low-complexity amplification DoS against recursive-resolver deployments that worsens with zero-TTL NS records, but mitigated in practice by the limited real-world footprint of the affected Rust resolver and the need for attacker-controlled malicious zones; prioritize as a scheduled (this-week) fix, especially noting the recursor crate is not yet patched.

An attacker registers two DNS zones whose name servers name-reference each other but publish no glue (IP) records, then induces a victim's Hickory recursive resolver to resolve a name under those zones. The recursor repeatedly chases the unresolvable cyclic referrals, issuing many upstream queries until its per-request budget is exhausted, and zero-TTL NS records inflate the query count further - amplifying load on the resolver and upstream infrastructure. No public exploit code is identified in the available sources.