Hickory DNS EUVD-2026-119356

Exploitation requires the target to be a Hickory resolver built with DNSSEC validation enabled (the dnssec-aws-lc-rs or dnssec-ring feature active) and actively performing DNSSEC chain validation - without these features the vulnerable DnssecDnsHandle DS-fetch path is not reached. The attacker must induce a transport-class error (SERVFAIL, REFUSED, or timeout) on the specific '<child>/DS' sub-query issued during DNSKEY chain validation; because that failure is described as transient and non-deterministic, reliable triggering depends on the attacker's ability to disrupt or race that upstream lookup rather than on a deterministic payload. Limiting factors that reduce realistic risk: only pre-release versions are affected (hickory-proto 0.25.0-alpha.1 .. 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 .. 0.26.1), the impact is confined to availability of names under the targeted child zone, and the denial automatically clears when the poisoned cache entry's TTL expires. No authentication is required (PR:N).

This is a denial-of-service weakness, not an information-disclosure or code-execution issue: the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores only availability (VA:L) with VC:N/VI:N, and the base score of 6.3 (Medium) reflects that a successful attack blocks resolution of an entire child zone rather than compromising confidentiality or integrity. The signals are internally consistent and point to a moderate, not emergency, priority: vuln.today assigns a 'this_month' decision label, the flaw is not in CISA KEV, and no EPSS probability was supplied. The AT:P (attack-requirements-present) metric aligns with the advisory's own language that the triggering DS-lookup failure is 'transient' and 'non-deterministic' - the attacker must successfully induce a transport-class error on a specific sub-query, which the validator then over-caches. PR:N indicates no authentication is required. The practical risk ceiling is bounded by three factors confirmed in the advisory: the target must be built with DNSSEC support enabled (dnssec-aws-lc-rs or dnssec-ring), only specific pre-release versions are affected, and the induced outage self-heals when the poisoned cache entry's TTL expires. Net assessment: a genuine availability bug worth patching on a normal cycle, but not a high-urgency, high-blast-radius issue - the Medium CVSS and 'this_month' label are not inflated.

An attacker who can cause a SERVFAIL, REFUSED, or timeout response to a validating Hickory resolver's '<child>/DS' sub-query (for example by disrupting or racing the upstream DS lookup during DNSKEY chain validation) triggers the validator to cache a synthetic Bogus verdict for the child zone. From that point every name under that zone returns SERVFAIL to downstream clients until the cache entry's TTL expires, producing a targeted DNS outage. No public exploit identified at time of analysis; the only published artifacts are the GHSA and VulnCheck advisories.