CVE-2026-123589 · Package
NO FIX YET · SEE WHAT TO DO
The DNS-over-QUIC server in hickory-server applies no timeout when reading a request from a QUIC stream, so it ignores its configured timeouts. A remote client without credentials can hold a stream open indefinitely, using up server resources and causing a denial of service.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only servers running hickory-server with the DNS-over-QUIC listener enabled are exposed, since the flaw sits in the DoQ request path. Teams using hickory-dns only as a client, or running DNS over UDP, TCP or DoT without DoQ, can skip it. Exposure depends on whether the DoQ port is reachable from untrusted networks.
Not affected if client-only, doq-disabled, no-dns-server
Who cares dns, hickory-dns, hickory-server, rust, self-hosted
hickory-server version in your Cargo.lock or dependency tree; affected releases are before 0.26.2.hickory-server 0.26.2The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely, consuming server resources and causing a denial of service.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.