The bug causes the hickory‑dns DNS server to halt its UDP listener and return an error when it receives a datagram that cannot be parsed as a valid DNS message. Attackers can send spoofed, malformed responses that mimic legitimate replies, forcing the server to abort active client queries. The resulting abrupt termination of DNS resolution constitutes a remote denial of service that can be repeated to degrade network responsiveness for affected clients. The weakness is identified as CWE‑696.

The issue affects the hickory‑dns project; the affected versions can be inferred as 0.26.0 and 0.26.1 from the CVE description. Systems running these releases, such as embedded routers or servers that use hickory‑dns as a local resolver, are susceptible. No other product versions are known to be affected.

The CVSS score of 8.2 indicates high severity, and the vulnerability is exploitable over the public network using UDP without requiring authentication. The EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation at present. However, the attack path—sending a crafted UDP response that the server cannot parse—only requires knowledge of the source port, a parameter that can be guessed or enumerated. Consequently, an attacker can repeatedly abort client queries, causing service disruption. The lack of a mitigation patch in older releases and the ability to trigger the failure from anywhere on the network increase the risk score.