Hickory DNS EUVD-2026-119347

Exploitation requires three concrete conditions to coincide: (1) the Hickory recursive resolver must follow a referral whose name-server records have no accompanying glue records, (2) all queries resolving those name servers' IP addresses must fail, and (3) the attacker must be able to spoof DNS responses to force those lookups to fail. The resulting cached empty connection pool then blocks all subsequent queries for the affected zone until the cache entry expires or is evicted. Limiting factors: only hickory-recursor (all versions) and hickory-resolver 0.26.0-0.26.1 are affected - upgrade to hickory-resolver 0.26.2 fixes the resolver, while hickory-recursor is not yet patched - and the attacker needs a DNS-spoofing position (on-path, or successful off-path blind spoofing), a meaningful barrier not reflected in the published AC:L/AT:N vector. No authentication (PR:N) or user interaction (UI:N) is required.

Signals are internally consistent and point to a genuine availability risk rather than a hype-driven high-CVSS item. The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VC:N/VI:N/VA:H describes a network-reachable, unauthenticated, availability-only denial of service - no confidentiality or integrity impact, matching CWE-754 (improper check for an unusual condition: an empty connection pool is cached and then reused). The prerequisite that an attacker be 'able to spoof DNS responses' is a real gating condition that AC:L/AT:N does not reflect, so practical attack complexity is higher than the raw vector implies - off-path or on-path DNS spoofing is non-trivial. No CISA KEV listing and no confirmed public exploit code were provided; the only PoC-adjacent material is the Hickory and VulnCheck advisories, so this is 'no public exploit identified at time of analysis', not confirmed active exploitation. EPSS was not supplied. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious but non-emergency DoS. Net: a credible, prioritizable availability bug worth patching this week, tempered by the spoofing prerequisite and the absence of exploitation-in-the-wild evidence.

An attacker positioned to spoof DNS responses forces all name-server IP lookups to fail while a Hickory recursive resolver follows a referral that contains no glue records. The resolver then caches an empty connection pool for that zone, so every subsequent query for the zone fails until the cache entry expires or is evicted, producing a denial of service. No public exploit identified at time of analysis; the attack requires a spoofing position but no authentication (PR:N) and no user interaction (UI:N).