{"id":"CVE-2026-123586","kind":"vulnerability","aliases":["CVE-2026-123586"],"related":[],"title":"Hickory DNS: recursive resolver amplifies queries via cyclic name server referrals","description":"Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.","summary":"Hickory DNS versions 0.25.0-alpha.3 through 0.25.2 mishandle cyclic sibling name server referrals that lack glue records. An attacker who controls two zones can make the resolver send many upstream queries, amplified further by zero-TTL NS records.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","runtime","rust","self-hosted"],"not_affected_if":["authoritative-only","forwarding-only"],"how_to_check":"- Run `hickory-dns --version` or check the Cargo.lock for `hickory-resolver` or `hickory-recursor` versions in the range 0.25.0-alpha.3 through 0.25.2\n- Check whether the recursive resolver feature is enabled in your Hickory DNS configuration","fix":"- Move to a version newer than `0.25.2` (the fixed version is not stated in the sources provided)","status":"open","published_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:22:52+00:00","updated_at":"2026-11-08T02:22:52+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-08T02:22:52Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version newer than `0.25.2` (the fixed version is not stated in the sources provided)","reach":"internet","title":"Hickory DNS: recursive resolver amplifies queries via cyclic name server referrals","impact":"medium","summary":"Hickory DNS versions 0.25.0-alpha.3 through 0.25.2 mishandle cyclic sibling name server referrals that lack glue records. An attacker who controls two zones can make the resolver send many upstream queries, amplified further by zero-TTL NS records.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["hickory-dns","dns","self-hosted","rust"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"resolver floods upstream name servers with amplified queries, causing denial of service","analyst_note":"Confirm the fixed version and whether the recursor is enabled by default; check the vendor advisory on github.com and the VulnCheck advisory.","how_to_check":"- Run `hickory-dns --version` or check the Cargo.lock for `hickory-resolver` or `hickory-recursor` versions in the range 0.25.0-alpha.3 through 0.25.2\n- Check whether the recursive resolver feature is enabled in your Hickory DNS configuration","plain_action":"","needs_analyst":true,"not_affected_if":["authoritative-only","forwarding-only"],"who_is_affected":"Teams running Hickory DNS as a recursive resolver, where the resolver answers queries from clients and resolves names by following referrals. Authoritative-only deployments and stub setups that forward to other resolvers are less exposed. Whether the default configuration is affected is unknown from the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4305,"output_tokens":636,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123586':14A,17A '-2026':13A,16A '0.25.0':30B,68C '0.25.2':33B,71C 'alpha.3':31B,69C 'amplif':75C 'amplifi':5A,58B,114C 'attack':45B,92C 'contain':72C 'control':47B,93C 'cve':12A,15A 'cyclic':8A,35B,83C 'dns':2A,18B,21B,28B,67C 'glue':42B,90C,103C 'hickori':1A,20B,27B,66C 'hickory-dn':19B 'host':26B 'lack':41B,89C 'loop':109C 'make':51B,106C 'mani':55B,111C 'mishandl':34B,82C 'name':9A,37B,85C,97C 'ns':64B,120C 'queri':6A,57B,74C,113C 'record':43B,65B,91C,104C,121C 'recurs':3A,79C 'recursor':108C 'refer':99C 'referr':11A,39B,87C 'resolv':4A,53B,80C 'runtim':22B 'rust':23B 'self':25B 'self-host':24B 'send':54B,110C 'server':10A,38B,86C,98C 'sibl':36B,84C 'ttl':63B,119C 'two':48B,94C 'upstream':56B,112C 'version':29B 'via':7A 'vulner':76C 'whose':96C 'without':102C 'zero':62B,118C 'zero-ttl':61B,117C 'zone':49B,95C","nicknames":[],"mitigations":[],"who_affected":"Teams running Hickory DNS as a recursive resolver, where the resolver answers queries from clients and resolves names by following referrals. Authoritative-only deployments and stub setups that forward to other resolvers are less exposed. Whether the default configuration is affected is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","high","runtime","rust","selfhosted"],"campaign_type":null,"search_a":"'-123586':14A,17A '-2026':13A,16A 'amplifi':5A 'cve':12A,15A 'cyclic':8A 'dns':2A 'hickori':1A 'name':9A 'queri':6A 'recurs':3A 'referr':11A 'resolv':4A 'server':10A 'via':7A","search_b":"'0.25.0':30B '0.25.2':33B 'alpha.3':31B 'amplifi':58B 'attack':45B 'control':47B 'cyclic':35B 'dns':18B,21B,28B 'glue':42B 'hickori':20B,27B 'hickory-dn':19B 'host':26B 'lack':41B 'make':51B 'mani':55B 'mishandl':34B 'name':37B 'ns':64B 'queri':57B 'record':43B,65B 'referr':39B 'resolv':53B 'runtim':22B 'rust':23B 'self':25B 'self-host':24B 'send':54B 'server':38B 'sibl':36B 'ttl':63B 'two':48B 'upstream':56B 'version':29B 'zero':62B 'zero-ttl':61B 'zone':49B","search_c":"'0.25.0':68C '0.25.2':71C 'alpha.3':69C 'amplif':75C 'amplifi':114C 'attack':92C 'contain':72C 'control':93C 'cyclic':83C 'dns':67C 'glue':90C,103C 'hickori':66C 'lack':89C 'loop':109C 'make':106C 'mani':111C 'mishandl':82C 'name':85C,97C 'ns':120C 'queri':74C,113C 'record':91C,104C,121C 'recurs':79C 'recursor':108C 'refer':99C 'referr':87C 'resolv':80C 'send':110C 'server':86C,98C 'sibl':84C 'ttl':119C 'two':94C 'upstream':112C 'vulner':76C 'whose':96C 'without':102C 'zero':118C 'zero-ttl':117C 'zone':95C","first_public_at":"2026-09-03T21:44:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123586","severity":null,"published_at":"2026-11-08T02:16:52+00:00","modified_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99323,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:44:00+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99324,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.25.0-alpha.3-through-0.25.2-query-amplification-via-cyclic-referrals","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}