---
id: "CVE-2026-123585"
page: "https://infrastack.ai/live/CVE-2026-123585"
kind: "vulnerability"
aliases: ["CVE-2026-123585"]
title: "Hickory DNS resolver follows irrelevant CNAME records, amplifying queries"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns", "hickory-dns", "hickory-resolver", "package", "rust"]
not_affected_if: ["authoritative-only", "managed-resolver"]
published_at: "2026-11-08T02:16:52+00:00"
first_seen_at: "2026-11-08T02:21:13+00:00"
updated_at: "2026-11-08T02:24:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123585", "first_seen_at": "2026-11-08T02:21:13+00:00"}]
exploit_sources: []
---

# Hickory DNS resolver follows irrelevant CNAME records, amplifying queries

Link for people: https://infrastack.ai/live/CVE-2026-123585 (this .md is for agents)

The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows CNAME records that are irrelevant to the original query when resolving recursive lookups. An attacker who controls DNS responses can cause extra resolver queries and query amplification.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Hickory DNS version in use, for example with `hickory-dns --version` or the `hickory-resolver` version in Cargo.lock
- Look for `hickory-resolver` 0.25.0 in dependency manifests to confirm the affected range

## Fix

- Hickory DNS: move to `0.26.2` or later

## Timeline

- 2026-11-08T02:21:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123585

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-query-amplification-via-irrelevant-cname-records

## From the sources

The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_