CVE-2026-123588 · Package
NO FIX YET · SEE WHAT TO DO
The recursive resolver in Hickory DNS caches an empty connection pool when a referral has no glue records and lookups for the name servers fail. An attacker who can spoof DNS responses can make all later queries for the affected zone fail until the cache entry expires.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed the hickory-recursor crate, or hickory-resolver 0.26.0 before 0.26.2, to perform recursive DNS resolution are exposed. The flaw needs an attacker able to spoof DNS responses, so services that resolve only through trusted upstream resolvers are less exposed. Teams that use the system resolver or a hosted DNS service and do not link these crates can skip it.
Not affected if no-hickory-dependency, system-resolver
Who cares dns, hickory-dns, rust, self-hosted
hickory-recursor or hickory-resolver in its lockfile (for example, cargo tree -i hickory-resolver).hickory-resolver version in use; versions from 0.26.0 up to but not including 0.26.2 are named as affected.hickory-recursor are named as affected.The recursive resolver in Hickory DNS (all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2) caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS responses can make these lookups fail, causing all subsequent queries for the affected zone to fail until the cache entry expires or is evicted.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hickory-resolver 0.26.2 (the sources name this as the first fixed version for the 0.26 line)hickory-recursor: unknown (the sources name no fixed version)