Hickory DNS versions 0.25.0-alpha.3 through 0.25.2 contain a query amplification vulnerability in the recursive resolver. The flaw arises when the resolver mishandles cyclic sibling name server referrals lacking glue records, allowing attackers to create a loop that causes the recursor to send numerous upstream queries. Amplification is further increased by zero‑TTL NS records. This leads to uncontrolled resource consumption, classified as CWE‑400, and can degrade availability by flooding the resolver with excessive traffic.

Affected are Hickory DNS products from the hickory‑dns project, specifically versions 0.25.0‑alpha.3 up to and including 0.25.2. No other vendor versions are listed.

The CVSS score of 8.7 indicates high severity, and while EPSS data is not available, the lack of a KEV listing suggests no known active exploitation, but the potential for amplification remains. The attack vector is inferred to be remote, requiring an attacker to control at least two DNS zones whose name servers reference each other without glue records. If such control is achieved, the resolver can be coerced into an infinite query loop, potentially allowing a denial‑of‑service impact on DNS resolution services.