{"id":"CVE-2026-123604","kind":"vulnerability","aliases":["CVE-2026-123604"],"related":[],"title":"Hickory DNS resolver: unbounded retry loop lets a malicious DNS server exhaust resources","description":"Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.","summary":"hickory-resolver 0.26.0-beta.1 before 0.26.2 re-queues truncated DNS responses forever without counting attempts or checking the transport. A malicious authoritative DNS server that keeps sending truncated replies can make the resolver spin on a TCP connection until the 5-second deadline, exhausting resources.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cargo","dns","hickory-resolver","package","rust"],"not_affected_if":["no-hickory-resolver","trusted-resolvers-only"],"how_to_check":"- Check the version of `hickory-resolver` in your lockfile (`Cargo.lock`) and look for `0.26.0-beta.1` or any version below `0.26.2`.\n- Find whether your application uses the hickory-resolver crate directly or through another dependency (`cargo tree -i hickory-resolver`).","fix":"- `hickory-resolver` `0.26.2` or later (the sources state the fix is in 0.26.2).","status":"open","published_at":"2026-11-08T02:16:55+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","triaged_at":"2026-11-08T02:22:47+00:00","updated_at":"2026-11-08T02:22:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:22:47Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-resolver` `0.26.2` or later (the sources state the fix is in 0.26.2).","reach":"network","title":"Hickory DNS resolver: unbounded retry loop lets a malicious DNS server exhaust resources","impact":"medium","summary":"hickory-resolver 0.26.0-beta.1 before 0.26.2 re-queues truncated DNS responses forever without counting attempts or checking the transport. A malicious authoritative DNS server that keeps sending truncated replies can make the resolver spin on a TCP connection until the 5-second deadline, exhausting resources.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-resolver","dns","cargo"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"resolver loops on a malicious server, exhausting CPU and connections","analyst_note":"","how_to_check":"- Check the version of `hickory-resolver` in your lockfile (`Cargo.lock`) and look for `0.26.0-beta.1` or any version below `0.26.2`.\n- Find whether your application uses the hickory-resolver crate directly or through another dependency (`cargo tree -i hickory-resolver`).","plain_action":"","needs_analyst":false,"not_affected_if":["no-hickory-resolver","trusted-resolvers-only"],"who_is_affected":"Applications written in Rust that use hickory-resolver 0.26.0-beta.1 to perform DNS lookups against servers that are not fully trusted. The exposure comes from resolving names through a server an attacker can control or influence, so services that only query fixed, trusted resolvers are less exposed. Teams that do not use hickory-resolver can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000753,"input_tokens":4322,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123604':16A,19A '-2026':15A,18A '0.26.0':30B,79C '0.26.2':33B,82C '1':113C '5':69B,128C 'answer':102C 'attempt':43B 'authorit':50B,109C 'beta.1':31B,80C 'cargo':20B 'caus':133C 'check':45B,100C 'connect':66B,125C 'contain':83C 'count':42B,105C 'cve':14A,17A 'deadlin':71B,131C 'dns':2A,10A,21B,38B,51B,75C 'everi':115C 'exhaust':12A,72B,135C 'expir':132C 'forev':40B 'hickori':1A,23B,28B,74C,77C 'hickory-resolv':22B,27B,76C 'iter':106C 'keep':54B,117C 'let':7A 'loop':6A,87C 'make':59B 'malici':9A,49B,108C 'nameserverpool':89C 'packag':25B 'persist':123C 'queue':36B,95C 're':35B,94C 're-queu':34B,93C 'repli':57B 'request':130C 'resolv':3A,24B,29B,61B,78C,119C 'resourc':13A,73B,134C 'respons':39B,98C 'retri':5A,86C 'return':111C 'rust':26B 'second':70B,129C 'send':55B,91C 'server':11A,52B,110C 'spin':62B,120C 'tc':97C,112C 'tcp':65B,124C 'transport':47B,103C,116C 'tri':90C 'truncat':37B,56B,96C 'unbound':4A,85C 'without':41B,99C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Rust that use hickory-resolver 0.26.0-beta.1 to perform DNS lookups against servers that are not fully trusted. The exposure comes from resolving names through a server an attacker can control or influence, so services that only query fixed, trusted resolvers are less exposed. Teams that do not use hickory-resolver can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cargo","dns","hickoryresolver","high","package","rust"],"campaign_type":null,"search_a":"'-123604':16A,19A '-2026':15A,18A 'cve':14A,17A 'dns':2A,10A 'exhaust':12A 'hickori':1A 'let':7A 'loop':6A 'malici':9A 'resolv':3A 'resourc':13A 'retri':5A 'server':11A 'unbound':4A","search_b":"'0.26.0':30B '0.26.2':33B '5':69B 'attempt':43B 'authorit':50B 'beta.1':31B 'cargo':20B 'check':45B 'connect':66B 'count':42B 'deadlin':71B 'dns':21B,38B,51B 'exhaust':72B 'forev':40B 'hickori':23B,28B 'hickory-resolv':22B,27B 'keep':54B 'make':59B 'malici':49B 'packag':25B 'queue':36B 're':35B 're-queu':34B 'repli':57B 'resolv':24B,29B,61B 'resourc':73B 'respons':39B 'rust':26B 'second':70B 'send':55B 'server':52B 'spin':62B 'tcp':65B 'transport':47B 'truncat':37B,56B 'without':41B","search_c":"'0.26.0':79C '0.26.2':82C '1':113C '5':128C 'answer':102C 'authorit':109C 'beta.1':80C 'caus':133C 'check':100C 'connect':125C 'contain':83C 'count':105C 'deadlin':131C 'dns':75C 'everi':115C 'exhaust':135C 'expir':132C 'hickori':74C,77C 'hickory-resolv':76C 'iter':106C 'keep':117C 'loop':87C 'malici':108C 'nameserverpool':89C 'persist':123C 'queue':95C 're':94C 're-queu':93C 'request':130C 'resolv':78C,119C 'resourc':134C 'respons':98C 'retri':86C 'return':111C 'second':129C 'send':91C 'server':110C 'spin':120C 'tc':97C,112C 'tcp':124C 'transport':103C,116C 'tri':90C 'truncat':96C 'unbound':85C 'without':99C","first_public_at":"2026-09-03T21:42:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123604","severity":null,"published_at":"2026-11-08T02:16:55+00:00","modified_at":"2026-11-08T02:16:55+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","fetched_at":"2026-11-08T02:21:14+00:00","note":null}],"documents":[{"id":99359,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:42:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99360,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-resource-exhaustion-dos-via-nameserverpool-try-send-tc-retry-loop","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}