CVE-2026-123604 · Package
NO FIX YET · SEE WHAT TO DO
hickory-resolver 0.26.0-beta.1 before 0.26.2 re-queues truncated DNS responses forever without counting attempts or checking the transport. A malicious authoritative DNS server that keeps sending truncated replies can make the resolver spin on a TCP connection until the 5-second deadline, exhausting resources.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications written in Rust that use hickory-resolver 0.26.0-beta.1 to perform DNS lookups against servers that are not fully trusted. The exposure comes from resolving names through a server an attacker can control or influence, so services that only query fixed, trusted resolvers are less exposed. Teams that do not use hickory-resolver can skip this.
Not affected if no-hickory-resolver, trusted-resolvers-only
Who cares cargo, dns, hickory-resolver, rust
hickory-resolver in your lockfile (Cargo.lock) and look for 0.26.0-beta.1 or any version below 0.26.2.cargo tree -i hickory-resolver).hickory-resolver 0.26.2 or later (the sources state the fix is in 0.26.2).Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.