The vulnerability occurs in the DnssecDnsHandle component of hickory-dns and hickory-net. It allows an attacker to trick the resolver into accepting NSEC3‑signed NODATA responses for zone‑apex queries as valid, even when no NSEC3 record matches the hashed query name. This error enables an on‑path attacker or a malicious authoritative server to present a signed non‑apex NSEC3 record with the zone’s SOA, causing the resolver to mark the apex query as authenticated‑denial (AD=1). The result is a denial of service for any apex RRtype, preventing legitimate resolution of the apex record and exposing DNS clients to a false sense of authenticity.

Affected versions are hickory-dns hickory-proto 0.25.0‑alpha.3 through 0.25.2 and hickory-net 0.26.0‑alpha.1 through 0.26.1.

The CVSS score is 6.3, classifying the issue as moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. Exposed to on‑path attackers or malicious authoritative servers, the flaw requires the ability to influence DNS responses for a given zone but has no requirement for privileged access on the resolver. The ability to subvert DNSSEC validation can lead to significant availability impact, but exploitation would likely be limited to environments where the attacker controls the network path or the authoritative server. Overall, the risk is moderate with limited but potentially disruptive impact.