The recursive resolver in Hickory DNS caches an empty connection pool when it follows a referral that has no glue records and fails to resolve the IP addresses of the referenced name servers. This flaw, classified as CWE‑754, permits an attacker who can spoof DNS responses to cause these lookups to fail, resulting in the resolver keeping the empty pool cached. All subsequent queries for that zone then fail until the cache expires or is evicted, effectively denying legitimate clients the ability to resolve names in that zone. The flaw requires no local privileges or authentication; it relies solely on the ability to send forged DNS responses to the resolver.

This issue affects all versions of the hickory‑recursor crate and the hickory‑resolver crate up to but excluding version 0.26.2. It impacts the Hickory DNS library, a Rust‑based DNS resolver used in many projects.

The CVSS score of 8.7 classifies the vulnerability as high severity. The EPSS score is not available, leaving the exact likelihood of exploitation uncertain. The vulnerability is also not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to place forged DNS responses in the path to the resolver, limiting the threat to environments where the resolver can be reached by unauthenticated external traffic.