Hickory DNS hickory-resolver 0.26.0-beta.1 through 0.26.1 contains an unbounded retry loop in the NameServerPool::try_send function. The loop re‑queues truncated (TC) responses without checking the transport channel or limiting the number of iterations. A malicious authoritative server that returns TC=1 on every response can cause the resolver to keep the TCP connection alive and retry repeatedly until the 5‑second request deadline expires, exhausting the resolver’s processing resources and rendering it unresponsive.

The affected product is Hickory DNS (hickory‑dns hickory‑resolver). Versions 0.26.0‑beta.1 up to and including 0.26.1 are impacted; the vulnerability is fixed in version 0.26.2 and later.

The CVSS score of 8.7 indicates a high severity vulnerability. No EPSS score is currently available and the issue is not listed in the CISA KEV catalog, but the exploitability remains significant because any authoritative DNS server that the resolver contacts could trigger the DoS. The attack requires the attacker to control or influence an authoritative server responding to queries made by the vulnerable resolver, which is feasible for external or internal adversaries depending on network segmentation.