Hickory DNS EUVD-2026-119361

Exploitation requires the recursor code path to be active: the hickory-recursor crate (all versions) or hickory-resolver 0.26.0-beta.1 through 0.26.1 with the optional 'recursor' feature enabled - resolvers without the recursor feature are not affected. The attacker must control (or have controlled) the zone's delegated name servers and must repeatedly send '<zone>. IN NS' queries to the recursor to keep the apex NS RRset cached. The attack only produces a security impact once the parent zone revokes or changes the delegation (AT:P captures this attacker-uncontrolled precondition); until revocation there is no divergence from correct resolution. No authentication or user interaction is required (PR:N/UI:N).

This is a genuine integrity flaw but a moderate, not top-tier, operational priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H) and the vuln.today 'this_week' label agree: network-reachable, unauthenticated, integrity-only impact (VI:H), with an attack requirement (AT:P) that reflects the real-world precondition that the parent zone must revoke or change its delegation for the attack to have effect. KEV status is not provided, so there is no confirmed active exploitation. No EPSS score is provided, so exploitation probability cannot be weighed - this is a missing signal, not a low one. No working exploit is referenced (only vendor and VulnCheck advisories), so this is no public exploit identified at time of analysis. The impact is bounded to integrity: an attacker who previously held a delegation can keep controlling DNS responses for a zone after revocation (a 'ghost domain'), which has no confidentiality or availability effect per the vector. Note a data conflict: the input tag 'Information Disclosure' contradicts the CVSS vector, which sets VC:N and VI:H - this is an integrity/control issue, not disclosure. Net: real and worth patching this week, but the requirement for a prior-then-revoked delegation and the niche footprint of the affected product keep it below emergency priority.

An attacker who operates (or operated) the name servers delegated for a zone continuously sends '<zone>. IN NS' queries to a Hickory DNS recursor, pinning the child-side apex NS RRset in cache indefinitely. When the parent registry later revokes or changes that delegation, the recursor keeps using the stale cached name servers for iterative resolution, so the attacker's servers continue answering for the zone past revocation. No confirmed working exploit code was identified; vendor and VulnCheck advisories describe the mechanism.