Hickory DNS 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a flaw in the validating recursor's handling of NSEC3 records. The recursor incorrectly accepts parent‑side ancestor‑delegation NSEC3 records as proof of nonexistence without verifying the type bitmap, enabling an attacker to craft a signed parent NSEC3 response that causes the recursor to cache NXDOMAIN or NODATA with a trusted signature. This flaw allows an attacker to deny resolution of existing names at and below the zone cut, effectively performing a cache poisoning denial of service. The weakness is a violation of DNSSEC validation logic, classified as CWE‑345.

The vulnerability affects the hickory-dns project. Vulnerable versions include hickory‑proto 0.25 through 0.26.0‑alpha.1 and hickory‑net 0.26.0‑beta.1 before 0.26.2. All builds of these versions are impacted and require remediation.

The CVSS score of 8.7 indicates high severity, and the flaw is exploitable in the natural operation of a validating recursor. While EPSS is not available, the nature of DNS security makes the probability of exploitation in environments that rely on recursive resolvers non‑negligible, especially where the recursor accepts responses from less trusted upstream servers. The vulnerability is not listed in the CISA KEV catalog, but the impact is sufficient to warrant prompt attention. The likely attack vector is a forged DNS response sent to the recursor over UDP or TCP, possibly via a rogue authoritative server or a crafted packet from a compromised network element.