---
id: "CVE-2026-123586"
page: "https://infrastack.ai/live/CVE-2026-123586"
kind: "vulnerability"
aliases: ["CVE-2026-123586"]
title: "Hickory DNS: recursive resolver amplifies queries via cyclic name server referrals"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["dns", "hickory-dns", "runtime", "rust", "self-hosted"]
not_affected_if: ["authoritative-only", "forwarding-only"]
published_at: "2026-11-08T02:16:52+00:00"
first_seen_at: "2026-11-08T02:21:13+00:00"
updated_at: "2026-11-08T02:22:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123586", "first_seen_at": "2026-11-08T02:21:13+00:00"}]
exploit_sources: []
---

# Hickory DNS: recursive resolver amplifies queries via cyclic name server referrals

Link for people: https://infrastack.ai/live/CVE-2026-123586 (this .md is for agents)

Hickory DNS versions 0.25.0-alpha.3 through 0.25.2 mishandle cyclic sibling name server referrals that lack glue records. An attacker who controls two zones can make the resolver send many upstream queries, amplified further by zero-TTL NS records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `hickory-dns --version` or check the Cargo.lock for `hickory-resolver` or `hickory-recursor` versions in the range 0.25.0-alpha.3 through 0.25.2
- Check whether the recursive resolver feature is enabled in your Hickory DNS configuration

## Fix

- Move to a version newer than `0.25.2` (the fixed version is not stated in the sources provided)

## Timeline

- 2026-11-08T02:21:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123586

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-0.25.0-alpha.3-through-0.25.2-query-amplification-via-cyclic-referrals

## From the sources

Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_