The vulnerability stems from the validating recursor in Hickory DNS, which incorrectly caches DNSSEC‑bogus answers using an attacker‑supplied record TTL capped at 24 hours instead of a short validation‑failure TTL. This flaw constitutes a CWE‑613 weakness. As a result, a remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can force the bogus result to be stored and used for up to 24 hours, allowing the attacker to redirect or intercept traffic through the recursor.

Affected editions include hickory‑dns 0.25.0 through 0.26.0‑alpha.1, hickory‑resolver 0.26.0‑alpha.1 before 0.26.2, and hickory‑net 0.26.0‑beta.1 before 0.26.2. These versions are distributed by the hickory‑dns project.

The CVSS score is 6.3, indicating a moderate impact. No EPSS score is available and the issue is not listed in the CISA KEV catalog, but its remote nature and lack of authentication requirements mean it can be successfully exploited in any environment that uses a vulnerable recursor. An attacker can craft a spoofed authoritative answer and inject a long TTL, causing the recursor to serve false data for a full day.