The flaw in Hickory DNS causes an absence of the RFC 6840 §4.4 check that verifies a delegating NSEC or NSEC3 record proves the existence of the corresponding NS record at the delegation point. An attacker can exploit this oversight by reusing child‑side NSEC or NSEC3 records to fabricate a false insecure delegation, allowing the attacker to forge child‑zone resource records. By presenting forged records to resolvers, the attacker can redirect queries, support phishing, or intercept traffic, compromising the integrity of the DNS infrastructure.

The vulnerability affects the Hickory DNS project. Versions of the hickory‑dns package from 0.26.0‑beta.1 up through, but not including, 0.26.2 are impacted, as are hickory‑proto releases up to 0.26.0‑alpha.1.

The CVSS score of 8.2 indicates a high severity. EPSS is not publicly available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of this attack vector does not diminish the risk. The flaw can be triggered over the network by crafted DNS queries, making it a remote, unauthenticated denial of strict DNSSEC validation. An attacker with the ability to influence DNS traffic can exploit the vulnerability to inject malicious records, elevating the threat to domain owners and end users.