CVE-2026-123606 · Package
NO FIX YET · SEE WHAT TO DO
The hickory-recursor and hickory-resolver Rust DNS libraries look up every out-of-bailiwick name server in a referral without a work limit. A remote attacker who serves crafted referrals can force many A and AAAA lookups, amplifying traffic against other servers or exhausting the recursor's resources.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams whose Rust code depends on hickory-recursor or hickory-resolver and runs a recursive resolver or resolves names against untrusted authoritative servers. An attacker must be able to answer queries with referrals, so exposure depends on how the resolver reaches remote name servers. Applications that only use a stub resolver against a trusted upstream are less exposed.
Not affected if no-hickory-dependency, stub-resolver-only, trusted-upstream
Who cares dns, hickory-dns, rust, self-hosted
grep -A1 'name = "hickory-recursor"' Cargo.lockgrep -A1 'name = "hickory-resolver"' Cargo.lock0.26.2 or later (from the advisory range, fixed in 0.26.2)The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.