{"id":"CVE-2026-123585","kind":"vulnerability","aliases":["CVE-2026-123585"],"related":[],"title":"Hickory DNS resolver follows irrelevant CNAME records, amplifying queries","description":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.","summary":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows CNAME records that are irrelevant to the original query when resolving recursive lookups. An attacker who controls DNS responses can cause extra resolver queries and query amplification.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","hickory-resolver","package","rust"],"not_affected_if":["authoritative-only","managed-resolver"],"how_to_check":"- Check the Hickory DNS version in use, for example with `hickory-dns --version` or the `hickory-resolver` version in Cargo.lock\n- Look for `hickory-resolver` 0.25.0 in dependency manifests to confirm the affected range","fix":"- Hickory DNS: move to `0.26.2` or later","status":"open","published_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:24:39+00:00","updated_at":"2026-11-08T02:24:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:24:39Z","model":"claude-haiku-5-5","output":{"fix":"- Hickory DNS: move to `0.26.2` or later","reach":"network","title":"Hickory DNS resolver follows irrelevant CNAME records, amplifying queries","impact":"low","summary":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows CNAME records that are irrelevant to the original query when resolving recursive lookups. An attacker who controls DNS responses can cause extra resolver queries and query amplification.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hickory-dns","hickory-resolver","rust","dns"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"resolver sends excess queries, causing query amplification and load","analyst_note":"","how_to_check":"- Check the Hickory DNS version in use, for example with `hickory-dns --version` or the `hickory-resolver` version in Cargo.lock\n- Look for `hickory-resolver` 0.25.0 in dependency manifests to confirm the affected range","plain_action":"","needs_analyst":false,"not_affected_if":["authoritative-only","managed-resolver"],"who_is_affected":"Systems running Hickory DNS 0.25.0 before 0.26.2 that perform recursive resolution, including any service embedding the hickory-resolver crate. Servers that only serve authoritative zones or that use a managed resolver are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000703,"input_tokens":4309,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123585':12A,15A '-2026':11A,14A '0.25.0':33B,72C '0.26.2':35B,74C 'addit':105C 'amplif':63B,123C 'amplifi':8A 'answer':89C 'attack':51B,93C 'author':103C 'caus':57B,116C 'chain':115C 'cname':6A,37B,77C,99C,114C 'compon':29B,68C 'control':53B,94C 'cve':10A,13A 'dns':2A,16B,19B,32B,54B,71C,95C 'excess':117C 'extra':58B 'follow':4A,36B,75C 'hickori':1A,18B,21B,27B,31B,66C,70C 'hickory-dn':17B 'hickory-resolv':20B,26B,65C 'includ':98C 'increas':121C 'irrelev':5A,41B,76C 'lookup':49B 'name':112C 'origin':44B,91C,110C 'outsid':108C 'packag':23B 'queri':9A,45B,60B,62B,82C,84C,111C,119C,122C 'record':7A,38B,78C,100C 'recurs':48B,81C 'request':92C 'resolv':3A,22B,28B,47B,59B,67C,80C,118C 'respons':55B,96C 'rust':24B 'section':106C 'send':83C 'unnecessari':87C","nicknames":[],"mitigations":[],"who_affected":"Systems running Hickory DNS 0.25.0 before 0.26.2 that perform recursive resolution, including any service embedding the hickory-resolver crate. Servers that only serve authoritative zones or that use a managed resolver are less exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","hickoryresolver","medium","package","rust"],"campaign_type":null,"search_a":"'-123585':12A,15A '-2026':11A,14A 'amplifi':8A 'cname':6A 'cve':10A,13A 'dns':2A 'follow':4A 'hickori':1A 'irrelev':5A 'queri':9A 'record':7A 'resolv':3A","search_b":"'0.25.0':33B '0.26.2':35B 'amplif':63B 'attack':51B 'caus':57B 'cname':37B 'compon':29B 'control':53B 'dns':16B,19B,32B,54B 'extra':58B 'follow':36B 'hickori':18B,21B,27B,31B 'hickory-dn':17B 'hickory-resolv':20B,26B 'irrelev':41B 'lookup':49B 'origin':44B 'packag':23B 'queri':45B,60B,62B 'record':38B 'recurs':48B 'resolv':22B,28B,47B,59B 'respons':55B 'rust':24B","search_c":"'0.25.0':72C '0.26.2':74C 'addit':105C 'amplif':123C 'answer':89C 'attack':93C 'author':103C 'caus':116C 'chain':115C 'cname':77C,99C,114C 'compon':68C 'control':94C 'dns':71C,95C 'excess':117C 'follow':75C 'hickori':66C,70C 'hickory-resolv':65C 'includ':98C 'increas':121C 'irrelev':76C 'name':112C 'origin':91C,110C 'outsid':108C 'queri':82C,84C,111C,119C,122C 'record':78C,100C 'recurs':81C 'request':92C 'resolv':67C,80C,118C 'respons':96C 'section':106C 'send':83C 'unnecessari':87C","first_public_at":"2026-09-03T21:52:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123585","severity":null,"published_at":"2026-11-08T02:16:52+00:00","modified_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99321,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:52:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99322,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-query-amplification-via-irrelevant-cname-records","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}