A flaw in Hickory DNS v0.26.0 and earlier versions and certain hickory‑proto releases allows a remote attacker to send a DNS response with an empty question section (QDCOUNT=0) to a UDP query. The server skips the check that the reply’s question section matches the original query and also bypasses the case randomization check, effectively weakening defenses against DNS spoofing. This permits an attacker to inject spoofed responses that could redirect traffic or compromise applications that rely on DNS integrity.

The vulnerability affects the Hickory DNS project, specifically the hickory-net component for versions 0.26.0 through 0.26.1 and the hickory-proto component for versions 0.25.0 through 0.25.2. Updating to hickory-net 0.26.2 or later and hickory-proto 0.25.3 or later removes the issue.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, which suggests no publicly known exploits yet. However, the condition requires the attacker to be able to inject UDP responses toward the DNS server, a capability that is common in many network environments. If the server is exposed to the Internet or a untrusted network segment, the risk of successful exploitation is significant. Mitigating the flaw and limiting inbound UDP traffic are therefore recommended.