CVE-2026-123585 · Package
NO FIX YET · SEE WHAT TO DO
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows CNAME records that are irrelevant to the original query when resolving recursive lookups. An attacker who controls DNS responses can cause extra resolver queries and query amplification.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Systems running Hickory DNS 0.25.0 before 0.26.2 that perform recursive resolution, including any service embedding the hickory-resolver crate. Servers that only serve authoritative zones or that use a managed resolver are less exposed; the sources do not say more.
Not affected if authoritative-only, managed-resolver
Who cares dns, hickory-dns, hickory-resolver, rust
hickory-dns --version or the hickory-resolver version in Cargo.lockhickory-resolver 0.25.0 in dependency manifests to confirm the affected range0.26.2 or laterThe hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.