The flaw allows an attacker who can supply DNS responses to combine a valid NSEC record and its RRSIG with a crafted SOA record that bypasses validation. This defeats DNSSEC checks and lets the attacker make the resolver believe that any requested resource record set does not exist, effectively forging non‑existence and allowing arbitrary denial of service or manipulation of domain resolution.

Hickory DNS, version 0.26.0 up to and including 0.26.1; affected component is the hickory-net crate used for DNSSEC validation.

An attacker can exploit this by intercepting or forging DNS responses to a Hickory DNS resolver. The CVSS score of 8.9 indicates high severity; EPSS data is unavailable, so the likelihood of exploitation is unknown, and it is not listed in the CISA KEV catalog. Attackers would need to supply responses to a vulnerable resolver, either through direct control of the resolver’s network path or by compromising a server the resolver queries.