Hickory DNS EUVD-2026-119366

Requires Hickory DNS built with the dnssec-ring or dnssec-aws-lc-rs feature AND configured to perform DNSSEC validation, so that DnssecDnsHandle is active - without DNSSEC validation the vulnerable NSEC3 closest-encloser code path is never reached. The attacker must be a reachable upstream party able to return a NoData or NXDomain response whose authority-section SOA record comes from a zone that is not an ancestor of the QNAME, on a response requiring NSEC3 closest-encloser proof (in practice reachable via an insecure CNAME chain crossing zone boundaries into a DNSSEC-signed zone, but the minimum condition is just a mismatched SOA owner). Limiting factors: the DNSSEC-validation configuration requirement, the need for an in-path/upstream position to deliver the crafted response, and that debug builds only panic (abort) while unbounded memory growth occurs on release builds.

This is a genuine but bounded availability threat. The CVSS 4.0 vector (CVSS:3.1 equivalent AV:N/AC:L/PR:N/UI:N/A:H) scores it 8.7/7.5, driven entirely by a high availability impact (VC:N/VI:N/VA:H) - there is no confidentiality or integrity consequence, so this is a pure denial-of-service. Exploitation requires no authentication (PR:N) and no user interaction, but the attacker must occupy an upstream/in-path DNS position able to return a crafted NoData or NXDomain response, and the victim must be running Hickory DNS with DNSSEC validation enabled (dnssec-ring or dnssec-aws-lc-rs feature) - this is a meaningful precondition the raw score does not convey. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was supplied in the input, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_week' (priority but not emergency). The real-world risk therefore concentrates on recursive resolvers/recursors built on affected Hickory versions with DNSSEC turned on, where a malicious or compromised upstream authoritative server can crash debug builds (panic on the debug_assert) or drive release builds to memory exhaustion. For deployments without DNSSEC validation or not using DnssecDnsHandle, the vulnerable code path is not reached.

An attacker controlling or able to inject responses for an authoritative nameserver returns a NoData or NXDomain answer whose authority-section SOA belongs to a zone that is not an ancestor of the queried name, on a path requiring NSEC3 closest-encloser proof (reachable, for example, via an insecure CNAME chain crossing into a DNSSEC-signed zone). A Hickory DNS resolver/recursor with DNSSEC validation enabled then enters the unbounded closest-encloser loop, panicking a debug build or allocating until the release build exhausts memory. No public exploit code was identified in the provided data, though the reporter (David Cook, ISRG / VulnCheck) describes the trigger condition precisely.