Hickory DNS EUVD-2026-119357

Exploitation requires the affected component running in DNSSEC-validating recursor/resolver mode (the validating recursor that caches validation outcomes), plus an attacker able to spoof an authoritative response for a targeted name carrying an invalid signature and a long TTL. Limiting factors: no special configuration beyond DNSSEC validation is stated, exploitation is unauthenticated (PR:N) but gated by an attack requirement (AT:P) - the attacker must be able to inject the spoofed authoritative reply, which the sources do not characterize as on-path or off-path; impact is bounded to denial-of-resolution for attacker-targeted names and self-heals within the 24-hour TTL cap, with no confidentiality or integrity compromise. hickory-resolver and hickory-net are fixed in 0.26.2; hickory-recursor has no fix available yet.

This is a moderate-priority, not emergency, issue and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw whose only impact is low availability to the vulnerable system (VA:L), with no confidentiality or integrity impact (VC:N/VI:N) - matching a cache-poisoning-of-failure bug rather than answer forgery. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the low 6.3 score and the bounded, self-healing impact (bogus state expires within 24 hours). AT:P (attack requirement present) reflects that the attacker must be able to inject a spoofed authoritative response; the sources do not describe the exact spoofing mechanism (on-path vs. off-path source-port/txid guessing), so the real-world difficulty of that step is not confirmed from the available data. No EPSS score, no CISA KEV listing, and no verified public exploit code were provided - this looks like a disclosed-by-researcher correctness bug (reported by Qifan Zhang, Palo Alto Networks, via VulnCheck) rather than something under active exploitation. Note one data tension: the 'Information Disclosure' tag conflicts with the CVSS impact set (VC:N/VI:N, only VA:L), so treat the impact as denial-of-resolution, not disclosure.

A remote attacker able to spoof an authoritative DNS response sends a single reply for a targeted name carrying an invalid DNSSEC signature and a long (up to 24-hour) record TTL. The validating recursor marks the answer bogus but caches that bogus/failure state for the attacker-supplied TTL instead of a short validation-failure TTL, so legitimate resolution of the targeted name fails until the cache entry expires. No public exploit code was identified at time of analysis; the attack requirement (AT:P) means the attacker must be positioned to inject the spoofed response.