A vulnerability in hickory-recursor versions from 0.25.0-alpha.3 onward allows an attacker controlling a DNS zone to cause the recursor to resolve every glueless name server in a referral without limits. This can lead to a large volume of queries being sent to victim servers (NXNSAttack pattern) or exhaustion of the recursor's resources. The recursor functionality moved to hickory-resolver starting with version 0.26.0-beta.1, and a fix is available in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should upgrade to hickory-resolver 0.26.2 or later with the recursor feature enabled.