{"id":"CVE-2026-123589","kind":"vulnerability","aliases":["CVE-2026-123589"],"related":[],"title":"hickory-dns: DNS-over-QUIC server holds connections open, causing denial of service","description":"The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely, consuming server resources and causing a denial of service.","summary":"The DNS-over-QUIC server in hickory-server applies no timeout when reading a request from a QUIC stream, so it ignores its configured timeouts. A remote client without credentials can hold a stream open indefinitely, using up server resources and causing a denial of service.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","hickory-server","package","rust","self-hosted"],"not_affected_if":["client-only","doq-disabled","no-dns-server"],"how_to_check":"- Check the `hickory-server` version in your Cargo.lock or dependency tree; affected releases are before `0.26.2`.\n- Check whether the DNS-over-QUIC (DoQ) listener is enabled in your hickory-dns configuration.","fix":"- `hickory-server` `0.26.2`","status":"open","published_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:24:36+00:00","updated_at":"2026-11-08T02:24:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:24:36Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-server` `0.26.2`","reach":"internet","title":"hickory-dns: DNS-over-QUIC server holds connections open, causing denial of service","impact":"low","summary":"The DNS-over-QUIC server in hickory-server applies no timeout when reading a request from a QUIC stream, so it ignores its configured timeouts. A remote client without credentials can hold a stream open indefinitely, using up server resources and causing a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hickory-dns","hickory-server","dns","rust","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote clients exhaust server resources and deny DNS service","analyst_note":"","how_to_check":"- Check the `hickory-server` version in your Cargo.lock or dependency tree; affected releases are before `0.26.2`.\n- Check whether the DNS-over-QUIC (DoQ) listener is enabled in your hickory-dns configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["doq-disabled","client-only","no-dns-server"],"who_is_affected":"Only servers running hickory-server with the DNS-over-QUIC listener enabled are exposed, since the flaw sits in the DoQ request path. Teams using hickory-dns only as a client, or running DNS over UDP, TCP or DoT without DoQ, can skip it. Exposure depends on whether the DoQ port is reachable from untrusted networks.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4300,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123589':18A,21A '-2026':17A,20A '0.26.2':97C 'appli':44B,100C 'bypass':112C 'caus':12A,77B,137C 'client':63B,119C 'configur':59B,114C 'connect':10A,123C 'consum':133C 'credenti':65B 'cve':16A,19A 'denial':13A,79B,139C 'dns':3A,5A,22B,25B,36B,84C,95C 'dns-over-qu':4A,35B,83C 'doq':87C 'hickori':2A,24B,27B,42B,91C,94C 'hickory-dn':1A,23B,93C 'hickory-serv':26B,41B,90C 'hold':9A,67B,129C 'host':33B 'ignor':57B 'indefinit':71B,132C 'messag':107C 'open':11A,70B,121C,131C 'packag':29B 'quic':7A,38B,53B,86C,110C 'read':48B,104C 'remot':62B,117C 'request':50B,106C,126C 'resourc':75B,135C 'rust':30B 'self':32B 'self-host':31B 'server':8A,28B,39B,43B,74B,88C,92C,134C 'servic':15A,81B,141C 'stream':54B,69B,111C,127C 'timeout':46B,60B,102C,115C 'unauthent':118C 'use':72B 'without':64B","nicknames":[],"mitigations":[],"who_affected":"Only servers running hickory-server with the DNS-over-QUIC listener enabled are exposed, since the flaw sits in the DoQ request path. Teams using hickory-dns only as a client, or running DNS over UDP, TCP or DoT without DoQ, can skip it. Exposure depends on whether the DoQ port is reachable from untrusted networks.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","hickoryserver","medium","package","rust","selfhosted"],"campaign_type":null,"search_a":"'-123589':18A,21A '-2026':17A,20A 'caus':12A 'connect':10A 'cve':16A,19A 'denial':13A 'dns':3A,5A 'dns-over-qu':4A 'hickori':2A 'hickory-dn':1A 'hold':9A 'open':11A 'quic':7A 'server':8A 'servic':15A","search_b":"'appli':44B 'caus':77B 'client':63B 'configur':59B 'credenti':65B 'denial':79B 'dns':22B,25B,36B 'dns-over-qu':35B 'hickori':24B,27B,42B 'hickory-dn':23B 'hickory-serv':26B,41B 'hold':67B 'host':33B 'ignor':57B 'indefinit':71B 'open':70B 'packag':29B 'quic':38B,53B 'read':48B 'remot':62B 'request':50B 'resourc':75B 'rust':30B 'self':32B 'self-host':31B 'server':28B,39B,43B,74B 'servic':81B 'stream':54B,69B 'timeout':46B,60B 'use':72B 'without':64B","search_c":"'0.26.2':97C 'appli':100C 'bypass':112C 'caus':137C 'client':119C 'configur':114C 'connect':123C 'consum':133C 'denial':139C 'dns':84C,95C 'dns-over-qu':83C 'doq':87C 'hickori':91C,94C 'hickory-dn':93C 'hickory-serv':90C 'hold':129C 'indefinit':132C 'messag':107C 'open':121C,131C 'quic':86C,110C 'read':104C 'remot':117C 'request':106C,126C 'resourc':135C 'server':88C,92C,134C 'servic':141C 'stream':111C,127C 'timeout':102C,115C 'unauthent':118C","first_public_at":"2026-09-03T21:48:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123589","severity":null,"published_at":"2026-11-08T02:16:52+00:00","modified_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99329,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-g8wg-4mwh-fjfv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:48:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99330,"url":"https://www.vulncheck.com/advisories/hickory-dns-before-0.26.2-denial-of-service-via-missing-dns-over-quic-request-read-timeout","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}