The vulnerability lies in the handling of NSEC and NSEC3 records used for DNSSEC non‑existence proofs. Accepting these records when any other record with the same owner name passes signature validation allows an attacker to embed bogus NSEC or NSEC3 entries of differing types in the authority section of a DNS response. This defeats the intended security guarantees of DNSSEC, enabling the attacker to forge proofs that a domain does not exist. The consequence is that resolvers may incorrectly deny legitimate queries or redirect traffic, effectively facilitating DNS cache poisoning or denial of service attacks against clients relying on this library.

Hickory DNS versions 0.26.0-beta.1 through 0.26.1 and 0.26.0-beta.1 up to 0.26.2 are affected, as well as Hickory Proto through 0.26.0-alpha.1. These are only the versions mentioned in the advisory; newer releases are presumed to contain the fix.

The CVSS score of 6.3 indicates a medium severity. EPSS is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote: an adversary who can inject or modify DNS responses (for example, a compromised authoritative nameserver or a man‑in‑the‑middle on the path) can exploit this flaw. No privileged access is required beyond the ability to send DNS responses.