CVE-2026-123586 · Runtime
NO FIX YET · SEE WHAT TO DO
Hickory DNS versions 0.25.0-alpha.3 through 0.25.2 mishandle cyclic sibling name server referrals that lack glue records. An attacker who controls two zones can make the resolver send many upstream queries, amplified further by zero-TTL NS records.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Hickory DNS as a recursive resolver, where the resolver answers queries from clients and resolves names by following referrals. Authoritative-only deployments and stub setups that forward to other resolvers are less exposed. Whether the default configuration is affected is unknown from the sources.
Not affected if authoritative-only, forwarding-only
Who cares dns, hickory-dns, rust, self-hosted
hickory-dns --version or check the Cargo.lock for hickory-resolver or hickory-recursor versions in the range 0.25.0-alpha.3 through 0.25.20.25.2 (the fixed version is not stated in the sources provided)Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.