{"id":"CVE-2026-123606","kind":"vulnerability","aliases":["CVE-2026-123606"],"related":[],"title":"Hickory DNS recursor: unbounded NS lookups let attackers amplify traffic","description":"The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.","summary":"The hickory-recursor and hickory-resolver Rust DNS libraries look up every out-of-bailiwick name server in a referral without a work limit. A remote attacker who serves crafted referrals can force many A and AAAA lookups, amplifying traffic against other servers or exhausting the recursor's resources.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","package","rust","self-hosted"],"not_affected_if":["no-hickory-dependency","stub-resolver-only","trusted-upstream"],"how_to_check":"- Check the hickory-recursor version in Cargo.lock, for example with `grep -A1 'name = \"hickory-recursor\"' Cargo.lock`\n- Check the hickory-resolver version in Cargo.lock, for example with `grep -A1 'name = \"hickory-resolver\"' Cargo.lock`\n- Look for hickory-recursor 0.25.0-alpha.3 through 0.25.2, or hickory-resolver 0.26.0-alpha.1 before 0.26.2","fix":"- hickory-resolver: `0.26.2` or later (from the advisory range, fixed in 0.26.2)\n- hickory-recursor: the sources do not name a fixed version for the 0.25 line","status":"open","published_at":"2026-11-08T02:16:55+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","triaged_at":"2026-11-08T02:22:47+00:00","updated_at":"2026-11-08T02:22:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:22:47Z","model":"claude-haiku-5-5","output":{"fix":"- hickory-resolver: `0.26.2` or later (from the advisory range, fixed in 0.26.2)\n- hickory-recursor: the sources do not name a fixed version for the 0.25 line","reach":"internet","title":"Hickory DNS recursor: unbounded NS lookups let attackers amplify traffic","impact":"medium","summary":"The hickory-recursor and hickory-resolver Rust DNS libraries look up every out-of-bailiwick name server in a referral without a work limit. A remote attacker who serves crafted referrals can force many A and AAAA lookups, amplifying traffic against other servers or exhausting the recursor's resources.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","dns","hickory-dns","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Resolver resources exhausted and remote servers flooded with lookups","analyst_note":"Confirm the hickory-recursor fixed version from the vendor advisory at github.com and whether the 0.25 line has a fix; the sources do not state it.","how_to_check":"- Check the hickory-recursor version in Cargo.lock, for example with `grep -A1 'name = \"hickory-recursor\"' Cargo.lock`\n- Check the hickory-resolver version in Cargo.lock, for example with `grep -A1 'name = \"hickory-resolver\"' Cargo.lock`\n- Look for hickory-recursor 0.25.0-alpha.3 through 0.25.2, or hickory-resolver 0.26.0-alpha.1 before 0.26.2","plain_action":"","needs_analyst":true,"not_affected_if":["stub-resolver-only","trusted-upstream","no-hickory-dependency"],"who_is_affected":"Teams whose Rust code depends on hickory-recursor or hickory-resolver and runs a recursive resolver or resolves names against untrusted authoritative servers. An attacker must be able to answer queries with referrals, so exposure depends on how the resolver reaches remote name servers. Applications that only use a stub resolver against a trusted upstream are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000827,"input_tokens":4338,"output_tokens":786,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123606':13A,16A '-2026':12A,15A '0.25.0':87C '0.25.2':90C '0.26.0':95C '0.26.2':98C 'aaaa':65B,129C 'alpha.1':96C 'alpha.3':88C 'amplifi':9A,67B,133C 'attack':8A,55B,120C 'bailiwick':43B,104C 'budget':118C 'craft':58B 'cve':11A,14A 'dns':2A,17B,20B,35B,81C 'everi':39B,100C 'exhaust':73B,139C 'forc':61B,126C 'glue':108C 'hickori':1A,19B,28B,32B,80C,85C,93C 'hickory-dn':18B,79C 'hickory-recursor':27B,84C 'hickory-resolv':31B,92C 'host':25B 'iter':99C 'lack':107C 'let':7A 'librari':36B 'limit':52B 'look':37B 'lookup':6A,66B,130C 'mani':62B 'name':44B 'ns':5A,105C 'out-of-bailiwick':40B,101C 'packag':21B 'per':115C,131C 'per-queri':114C 'queri':116C 'recursor':3A,29B,75B,82C,86C,140C 'referr':48B,59B,111C,124C 'remot':54B,119C,136C 'resolv':33B,94C 'resourc':77B,141C 'rust':22B,34B 'self':24B 'self-host':23B 'serv':57B,122C 'server':45B,71B,137C 'target':106C,132C 'traffic':10A,68B,134C 'unbound':4A 'without':49B,112C 'work':51B,117C","nicknames":[],"mitigations":[],"who_affected":"Teams whose Rust code depends on hickory-recursor or hickory-resolver and runs a recursive resolver or resolves names against untrusted authoritative servers. An attacker must be able to answer queries with referrals, so exposure depends on how the resolver reaches remote name servers. Applications that only use a stub resolver against a trusted upstream are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","high","package","rust","selfhosted"],"campaign_type":null,"search_a":"'-123606':13A,16A '-2026':12A,15A 'amplifi':9A 'attack':8A 'cve':11A,14A 'dns':2A 'hickori':1A 'let':7A 'lookup':6A 'ns':5A 'recursor':3A 'traffic':10A 'unbound':4A","search_b":"'aaaa':65B 'amplifi':67B 'attack':55B 'bailiwick':43B 'craft':58B 'dns':17B,20B,35B 'everi':39B 'exhaust':73B 'forc':61B 'hickori':19B,28B,32B 'hickory-dn':18B 'hickory-recursor':27B 'hickory-resolv':31B 'host':25B 'librari':36B 'limit':52B 'look':37B 'lookup':66B 'mani':62B 'name':44B 'out-of-bailiwick':40B 'packag':21B 'recursor':29B,75B 'referr':48B,59B 'remot':54B 'resolv':33B 'resourc':77B 'rust':22B,34B 'self':24B 'self-host':23B 'serv':57B 'server':45B,71B 'traffic':68B 'without':49B 'work':51B","search_c":"'0.25.0':87C '0.25.2':90C '0.26.0':95C '0.26.2':98C 'aaaa':129C 'alpha.1':96C 'alpha.3':88C 'amplifi':133C 'attack':120C 'bailiwick':104C 'budget':118C 'dns':81C 'everi':100C 'exhaust':139C 'forc':126C 'glue':108C 'hickori':80C,85C,93C 'hickory-dn':79C 'hickory-recursor':84C 'hickory-resolv':92C 'iter':99C 'lack':107C 'lookup':130C 'ns':105C 'out-of-bailiwick':101C 'per':115C,131C 'per-queri':114C 'queri':116C 'recursor':82C,86C,140C 'referr':111C,124C 'remot':119C,136C 'resolv':94C 'resourc':141C 'serv':122C 'server':137C 'target':106C,132C 'traffic':134C 'without':112C 'work':117C","first_public_at":"2026-09-03T21:46:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123606","severity":null,"published_at":"2026-11-08T02:16:55+00:00","modified_at":"2026-11-08T02:16:55+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","fetched_at":"2026-11-08T02:21:14+00:00","note":null}],"documents":[{"id":99363,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6h5c-jjg5-wj59","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:46:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99364,"url":"https://www.vulncheck.com/advisories/hickory-dns-recursor-0.25.0-alpha.3-through-0.25.2-glueless-ns-referral-amplification","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}