The vulnerability resides in the DNS wire‑format parser of Hickory DNS 0.18 up to 0.26.1. The parser preallocates memory for the answer, authority and additional record vectors based solely on the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before it reads the record data. An attacker can craft a UDP packet, or a spoofed DNS response, setting these counts to the maximum value of 65535. This causes the server to allocate roughly 18 MB of memory for each message, potentially exhausting system resources and leading to a denial‑of‑service state for the affected process. The issue is reflected in CWE‑400, a shortage or abuse of resources.

Any deployment of Hickory DNS between version 0.18 and 0.26.1 inclusive is affected. The affected products are "hickory-dns:hickory-dns" and the vulnerability applies to any resolver instance running these versions, regardless of the operating system host or environment.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, but the absence of a KEV listing suggests no active public exploits are known at the time of analysis. Attackers can exploit this flaw simply by sending a malicious DNS request or spoofed response directed at the resolver’s UDP port 53. No authentication or privileged access is required, making the vulnerability readily exploitable by unsophisticated adversaries.