A vulnerability in Hickory net versions 0.26.0 up to but not including 0.26.2 allows an off-path attacker to cause DNS lookups to fail by sending a single spoofed malformed UDP datagram. The client improperly parses every incoming datagram from the name server before verifying the message ID, causing the lookup to abort on parsing failure. This issue is fixed in version 0.26.2.