The vulnerability allows an attacker to generate DNS referrals that lack glue records for out‑of‑bailiwick nameservers. Each referral triggers the recursor to perform A and AAAA lookups for every target without any per‑query work budget. This can amplify the amount of traffic the recursor must handle, potentially exhausting system resources and causing service disruption. The weakness is a classic example of a resource exhaustion flaw (CWE‑400).

Affected products are hickory‑dns recursor 0.25.0‑alpha.3 through 0.25.2 and hickory‑resolver 0.26.0‑alpha.1 before 0.26.2. Clients running any of these released versions are impacted.

The CVSS score of 8.7 indicates a high severity level. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, but it could be exploited by any external party that can send crafted DNS queries to the recursor. Attackers can trigger amplification or resource exhaustion by serving the malicious referrals from a network positioned to reach the recursor. The lack of a per‑query workload limit makes the attack straightforward and likely to succeed if the network path is reachable.