The vulnerability in the DNS-over-QUIC (DoQ) server of hickory-dns lies in the omission of a request read timeout. A remote, unauthenticated client can initiate a QUIC connection and request stream, then keep it open indefinitely. Because the server does not enforce any timeout, it continues to allocate resources to the stalled stream. This resource exhaustion leads to denial of service against the affected server, potentially affecting service availability for legitimate traffic.

The issue applies to hickory-dns versions prior to 0.26.2. Any deployment of hickory-dns earlier than 0.26.2 that processes DNS-over-QUIC traffic is vulnerable.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, so the current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting no public evidence of active exploitation yet. However, the attack vector is remote, unauthenticated, and only requires an open network connection to the QUIC port of the DNS server. An attacker can repeatedly open connection streams to consume server memory and processing capacity, eventually denying service to legitimate clients.