The flaw lies in the NSEC handler of the validating recursor, allowing parent‑side ancestor‑delegation NSEC records to be treated as proof of nonexistence for names beneath a zone cut. An attacker can forge an NXDOMAIN response from genuine parent NSEC data, causing resolvers to incorrectly cache a negative result for legitimate child‑zone names. This results in denial of resolution for those names while the negative TTL is active.

Affected vendor: Hickory DNS. Products: hickory-proto up to and including 0.26.0‑alpha.1 and hickory-net 0.26.0‑beta.1 before 0.26.2. The vulnerability exists in versions prior to those releases.

The CVSS score of 8.7 indicates a high severity. Although the EPSS score is not available, the vulnerability can be exploited by an on‑path or rogue parent nameserver, or by an attacker winning a port and TXID race. The vulnerability is not listed in CISA KEV, but its high impact and relatively likely attack surface suggest it is a significant concern for exposed recursive resolvers.