The vulnerability exists in the hickory-resolver component of Hickory DNS 0.25.0 through 0.26.1. It permits attackers controlling DNS responses to include irrelevant CNAME records in the authority or additional sections, or outside the original query name’s CNAME chain, causing the resolver to perform unnecessary recursive queries. This leads to query amplification, increasing DNS traffic and potentially exhausting bandwidth or processor resources in the resolver host.

Affected products include Hickory DNS, specifically the hickory-dns component. Vulnerable versions are 0.25.0 up to and including 0.26.1.

The CVSS score of 6.9 indicates moderate severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified precisely, but the flaw can be exercised by any actor who can inject or spoof DNS responses for a target domain. Attackers who control DNS responses can trigger the resolver to issue many unnecessary queries, amplifying traffic and stressing upstream infrastructure. The vulnerability is not listed in CISA’s KEV catalog.