{"id":"CVE-2026-123588","kind":"vulnerability","aliases":["CVE-2026-123588"],"related":[],"title":"Hickory DNS: failed referral lookups cache an empty pool, blocking zone resolution","description":"The recursive resolver in Hickory DNS (all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2) caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS responses can make these lookups fail, causing all subsequent queries for the affected zone to fail until the cache entry expires or is evicted.","summary":"The recursive resolver in Hickory DNS caches an empty connection pool when a referral has no glue records and lookups for the name servers fail. An attacker who can spoof DNS responses can make all later queries for the affected zone fail until the cache entry expires.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","package","rust","self-hosted"],"not_affected_if":["no-hickory-dependency","system-resolver"],"how_to_check":"- Check whether the project depends on `hickory-recursor` or `hickory-resolver` in its lockfile (for example, `cargo tree -i hickory-resolver`).\n- Check the `hickory-resolver` version in use; versions from `0.26.0` up to but not including `0.26.2` are named as affected.\n- Note that all versions of `hickory-recursor` are named as affected.","fix":"- `hickory-resolver` `0.26.2` (the sources name this as the first fixed version for the 0.26 line)\n- `hickory-recursor`: unknown (the sources name no fixed version)","status":"open","published_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:22:48+00:00","updated_at":"2026-11-08T02:22:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:22:48Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-resolver` `0.26.2` (the sources name this as the first fixed version for the 0.26 line)\n- `hickory-recursor`: unknown (the sources name no fixed version)","reach":"network","title":"Hickory DNS: failed referral lookups cache an empty pool, blocking zone resolution","impact":"medium","summary":"The recursive resolver in Hickory DNS caches an empty connection pool when a referral has no glue records and lookups for the name servers fail. An attacker who can spoof DNS responses can make all later queries for the affected zone fail until the cache entry expires.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dns","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Zone lookups fail for every query until the cached entry expires.","analyst_note":"Confirm the fixed version for hickory-recursor (sources name none) and read the vendor advisory on GitHub to confirm the affected range.","how_to_check":"- Check whether the project depends on `hickory-recursor` or `hickory-resolver` in its lockfile (for example, `cargo tree -i hickory-resolver`).\n- Check the `hickory-resolver` version in use; versions from `0.26.0` up to but not including `0.26.2` are named as affected.\n- Note that all versions of `hickory-recursor` are named as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["system-resolver","no-hickory-dependency"],"who_is_affected":"Applications that embed the hickory-recursor crate, or hickory-resolver 0.26.0 before 0.26.2, to perform recursive DNS resolution are exposed. The flaw needs an attacker able to spoof DNS responses, so services that resolve only through trusted upstream resolvers are less exposed. Teams that use the system resolver or a hosted DNS service and do not link these crates can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4320,"output_tokens":720,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123588':15A,18A '-2026':14A,17A '0.26.0':93C '0.26.2':95C 'abl':122C 'address':118C 'affect':67B,138C 'attack':54B,121C 'block':10A 'cach':6A,34B,72B,96C,144C 'caus':132C 'connect':37B,99C 'crate':88C 'cve':13A,16A 'dns':2A,19B,22B,33B,58B,80C,125C 'empti':8A,36B,98C 'entri':73B,145C 'evict':149C 'expir':74B,146C 'fail':3A,52B,69B,119C,131C,141C 'follow':103C 'glue':44B,108C 'hickori':1A,21B,32B,79C,86C,91C 'hickory-dn':20B 'hickory-recursor':85C 'hickory-resolv':90C 'host':27B 'ip':117C 'later':63B 'lookup':5A,47B,130C 'make':61B,128C 'name':50B,115C 'packag':23B 'pool':9A,38B,100C 'queri':64B,112C,135C 'record':45B,109C 'recurs':29B,76C 'recursor':87C 'referr':4A,41B,105C 'resolut':12A 'resolv':30B,77C,92C 'respons':59B,126C 'rust':24B 'self':26B 'self-host':25B 'server':51B,116C 'spoof':57B,124C 'subsequ':134C 'version':82C 'zone':11A,68B,139C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed the hickory-recursor crate, or hickory-resolver 0.26.0 before 0.26.2, to perform recursive DNS resolution are exposed. The flaw needs an attacker able to spoof DNS responses, so services that resolve only through trusted upstream resolvers are less exposed. Teams that use the system resolver or a hosted DNS service and do not link these crates can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","high","package","rust","selfhosted"],"campaign_type":null,"search_a":"'-123588':15A,18A '-2026':14A,17A 'block':10A 'cach':6A 'cve':13A,16A 'dns':2A 'empti':8A 'fail':3A 'hickori':1A 'lookup':5A 'pool':9A 'referr':4A 'resolut':12A 'zone':11A","search_b":"'affect':67B 'attack':54B 'cach':34B,72B 'connect':37B 'dns':19B,22B,33B,58B 'empti':36B 'entri':73B 'expir':74B 'fail':52B,69B 'glue':44B 'hickori':21B,32B 'hickory-dn':20B 'host':27B 'later':63B 'lookup':47B 'make':61B 'name':50B 'packag':23B 'pool':38B 'queri':64B 'record':45B 'recurs':29B 'referr':41B 'resolv':30B 'respons':59B 'rust':24B 'self':26B 'self-host':25B 'server':51B 'spoof':57B 'zone':68B","search_c":"'0.26.0':93C '0.26.2':95C 'abl':122C 'address':118C 'affect':138C 'attack':121C 'cach':96C,144C 'caus':132C 'connect':99C 'crate':88C 'dns':80C,125C 'empti':98C 'entri':145C 'evict':149C 'expir':146C 'fail':119C,131C,141C 'follow':103C 'glue':108C 'hickori':79C,86C,91C 'hickory-recursor':85C 'hickory-resolv':90C 'ip':117C 'lookup':130C 'make':128C 'name':115C 'pool':100C 'queri':112C,135C 'record':109C 'recurs':76C 'recursor':87C 'referr':105C 'resolv':77C,92C 'respons':126C 'server':116C 'spoof':124C 'subsequ':134C 'version':82C 'zone':139C","first_public_at":"2026-09-03T21:54:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123588","severity":null,"published_at":"2026-11-08T02:16:52+00:00","modified_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99327,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-9px7-7m25-f6q2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:54:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99328,"url":"https://www.vulncheck.com/advisories/hickory-dns-recursive-resolver-denial-of-service-via-cached-empty-connection-pool","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}