The vulnerability is an unbounded loop in the NSEC3 closest‑encloser proof validation routine of the DNS server. When the SOA owner is not an ancestor of the queried name, malformed or crafted responses containing a cross‑zone SOA record can trigger the loop. In debug builds the process panics; in release builds the loop consumes growing amounts of memory, eventually exhausting the server and causing service outages. The weakness is classified as CWE‑835, uncontrolled resource consumption.

The affected code ranges from hickory‑dns hickory‑proto 0.25.0‑alpha.3 to 0.25.2 inclusive, and hickory‑net versions prior to 0.26.1. Both are distributed by the hickory‑dns project under the same vendor name, hickory‑dns.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the nature of DNS exposes the server to network‑level attackers. A threat actor possessing the ability to send custom DNS responses can exploit the unbounded loop by targeting any client that relies on the vulnerable server, potentially leading to a denial of service.