The vulnerability exists in the hickory‑proto, hickory‑resolver, hickory‑server, and hickory‑recursor libraries up to specified versions. It causes the components to fail to canonicalize IPv4‑mapped IPv6 addresses when evaluating deny rules, potentially allowing an attacker to bypass configured DNS answer filtering, reach otherwise blocked name servers, or trick the library into accepting traffic from denied clients over a dual‑stack IPv6 socket. The result is illicit exposure of cached responses or the ability to query undesired name servers, compromising confidentiality and potentially integrity of name resolution data.

Victim systems that run any of the Hickory DNS families with the affected releases—hickory‑proto and hickory‑resolver version 0.26.0 and 0.26.1, hickory‑server 0.25.0‑alpha.1 up through 0.26.1, and hickory‑recursor 0.25.0‑alpha.3 up to 0.26.0‑alpha.1—are susceptible. These components are used in many Docker images and DNS server deployments that support dual‑stack IPv4/IPv6 operation.

The CVSS base score is 6.9, indicating moderate severity. No exploit probability report (EPSS) is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that there are no publicly known or tracked exploits at this time. The attack can be carried out remotely by sending crafted DNS queries that include IPv4‑mapped addresses to a vulnerable server that has deny‑rules enabled. Because the flaw is purely a logical error in address canonicalisation, an attacker does not need privileged access and can exploit the weakness from any network location that interacts with the DNS service.