A vulnerability in hickory-recursor allows it to repeatedly query cyclic glueless sibling delegations between two zones, causing excessive upstream queries. This occurs because the recursor does not stop resolving when it encounters a zone it is already processing. The issue affects versions starting from 0.25.0-alpha.3. The recursor code has moved to hickory-resolver with an opt-in feature, and a fix is available in hickory-resolver 0.26.2. No fixed release exists for hickory-recursor itself.