A logic bug in the DS-fetch path of Hickory DNS causes transient DS lookup errors to be cached as bogus DNSSEC validation verdicts. When an attacker induces a SERVFAIL, REFUSED or timeout response to a child‑zone DS sub‑query, the validator returns SERVFAIL for every name under that zone until the cache entry’s TTL expires, effectively denying resolution for those names. This represents a service disruption vulnerability in the DNSSEC validation process, classified as CWE‑613.

Hickory DNS, specifically hickory‑proto versions 0.25.0‑alpha.1 through 0.26.0‑alpha.1 and hickory‑net versions prior to 0.26.2.

The CVSS score is 6.3, indicating a moderate severity; EPSS data is not available and the CVE is not listed in the CISA KEV catalog. Attackers can trigger the condition by inducing a SERVFAIL, REFUSED, or timeout response to a child‑zone DS sub‑query, causing the validator to return SERVFAIL for all names under that zone until the cache entry’s TTL expires. The vulnerability remains exploitable until the affected package is upgraded beyond the versions listed above.