Hickory DNS EUVD-2026-119365

Exploitation requires the hickory-dns recursor functionality to be in use - in the hickory-resolver 0.26.x line this is behind the opt-in 'recursor' feature, and in hickory-recursor it is the 0.25.0-alpha.3 through 0.25.2 crate - and the attacker must be able to get the victim recursor to resolve a name within a zone whose authoritative referral the attacker controls (serving a referral whose NS targets are out-of-bailiwick and have no glue records). The specific trigger named in the advisory is a referral RRset of such glueless, out-of-bailiwick NS targets, which the recursor iterates in full because only chain-depth limits exist and there is no cap on referral width or per-client-query upstream work budget. Limiting factors: the recursor must be deployed and reachable, must be on an affected version range, and (for 0.26.x) must have the recursor feature explicitly enabled; impact is confined to availability (traffic amplification against third parties or exhaustion of the recursor), with no confidentiality or integrity effect.

This is a resource-exhaustion / traffic-amplification denial-of-service flaw (CWE-400, with GHSA also citing CWE-406 and CWE-770), explicitly characterized as the same class as the 2020 NXNSAttack (CVE-2020-8616 / CVE-2020-12662). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) indicates a remotely reachable, low-complexity, unauthenticated condition with no confidentiality or integrity impact and high availability impact - consistent with the description. The decision label is 'this_week' (not act_now/emergency), and there is NO CISA KEV entry and NO EPSS score in the input, so exploitation probability cannot be quantified from the provided data. No confirmed proof-of-concept exploit code is present - the only references are the GHSA advisory and a VulnCheck advisory (descriptive write-ups), so this is 'no public exploit identified at time of analysis.' Signals are internally consistent (high-severity DoS, remote unauthenticated) but the real-world priority is tempered by two factors the input makes explicit: the recursor must actually be deployed and reachable, and in the 0.26 line the recursor is behind an opt-in 'recursor' feature. Note a KEV-free, EPSS-absent profile on a niche Rust library points to a credible-but-not-yet-widespread-exploited issue rather than mass active exploitation. One data gap: the hickory-recursor crate (0.25.0-alpha.3..0.25.2) is listed as 'not yet patched,' so operators on that crate have no fixed version to move to.

An attacker operates (or induces queries toward) an authoritative zone and, when the victim's hickory-dns recursor resolves a name in that zone, returns a referral containing many out-of-bailiwick NS targets that have no glue. The recursor then issues A and AAAA lookups for every one of those targets with no per-query work budget, multiplying upstream traffic to amplify a flood against third-party servers or to exhaust the recursor's own resources. No authenticated access and no user interaction are required (PR:N/UI:N); no confirmed public exploit code is available, though the technique mirrors the well-documented NXNSAttack.