The recursive resolver in Hickory DNS fails to apply bailiwick filtering to negative responses. Attackers that can supply crafted negative replies may embed out‑of‑bailiwick records, resulting in cache poisoning. This allows malicious hosts to be served in place of legitimate ones, and can also make other DNSSEC verification flaws easier to exploit, so the integrity of DNS queries is compromised.

The vulnerability affects Hickory DNS hickory-recursor versions 0.25.0 through 0.25.2 and hickory-resolver versions 0.26.0 through 0.26.1. Vendor ownership is by the hickory-dns organization, and the affected products are the recursive resolver component (hickory-recursor) and the resolver library (hickory-resolver). The specific affected releases are 0.25.0‑0.25.2 for hickory-recursor, and 0.26.0‑0.26.1 for hickory-resolver.

The CVSS score of 6.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not in the CISA KEV catalog. The likely attack vector requires an attacker to influence or spoof negative DNS responses, implying network‑level access or the compromise of an upstream server. No mitigations are listed as a workaround, so official recall of unpatched versions is the only recommended remediation. The risk is significant for environments that rely on the affected resolver for DNS resolution.