The vulnerability arises from inverted relational operators in the wrap‑around branch of the find_covering_record() function within nsec3.rs, causing the last NSEC3 record of a zone’s hash ring to incorrectly cover every hash value except its own owner. An attacker who can inject DNS responses can replay this mis‑calculated NSEC3 record and its associated RRSIG, forging DNSSEC‑validated negative responses that falsely state that legitimate domain names do not exist. This flaw undermines the authenticity guarantees of DNSSEC and can be used to deny legitimate name resolutions, potentially disrupting access to services without providing any viable URL or IP to the user.

Hickory DNS is affected in all releases of the hickory‑proto library from version 0.25.0 through 0.26.0‑alpha.1, as well as the hickory‑net library from 0.26.0‑beta.1 up to any version preceding 0.26.2. These versions are currently deployed in many open‑routed DNS servers that rely on the library for NSEC3 processing.

The CVSS score of 8.3 indicates that this flaw is highly exploitable, providing attackers the means to forge authenticated negative responses and disrupt DNS resolution for targeted stakeholders. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, but the lack of a KEV listing does not mitigate the impact of the vulnerability. Attackers would need the ability to inject DNS responses, typically requiring network access to a server or the ability to spoof source IP addresses, and must be able to target zones where NSEC3 is enabled. Once executed, the forgery can silently mislead DNS resolvers, effectively denying service to the affected domain names without detection by standard validation mechanisms.