Hickory DNS versions before 0.26.2 are susceptible to a resource exhaustion flaw in their DNS-over-HTTPS HTTP/2 server. The vulnerability arises when the server accepts incomplete request bodies without appropriate timeouts or size limits. An attacker can open DoH connections, send partial request data, and keep the connections alive, causing the server to consume increasing amounts of memory and ultimately degrade or deny service. The weakness is classified as CWE‑770 and can lead to denial of service for legitimate users.

The affected product is Hickory DNS from the hickory‑dns project. All releases prior to 0.26.2 are impacted. There is no granular sub‑version list available; any build before 0.26.2 inherits the flaw.

The CVSS score of 8.7 indicates a high severity risk. EPSS is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not yet listed in CISA KEV. The likely attack vector is remote; an adversary must be able to initiate DoH connections to the vulnerable server. Since the attack requires no special privileges and only involves sending incomplete request bodies, the exploitation effort is relatively low once the network path exists.