Technical impact
The vulnerability allows an attacker to inject malicious data into the recursor’s cache for zones that were not the original query target, enabling the return of forged DNS responses. This can redirect users to malicious sites or disrupt resolution for victim zones. The weakness is a flaw in how cached data is tied to queries (CWE-706). The problem is not a high‑severity code execution flaw, but it can degrade trust in DNS resolution in the affected system.
Affected Systems
The issue affects the Hickory Project Hickory DNS recursor from version 0.1 up to and including 0.25.2. Any deployment of the recursor within this version range is vulnerable.
Risk and Exploitability
The CVSS score of 4 indicates moderate severity. Exploitation requires only sending crafted DNS requests to the recursor, so the attack vector is the network. The EPSS score of less than 1% suggests a low likelihood of real‑world exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw can lead to unauthorized DNS record injection, it poses a tangible risk to the integrity of DNS data in systems that expose the recursor to untrusted networks.
