Read the docs
TI-2026-68396 Aliases GHSA-6w6g-hm98-mhgm

hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

Priority LOW 38CWE-400Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-400.

Summary

When the `hickory-resolver` name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets `TC=1` on **every** available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires. ### Reporter Qifan Zhang, Palo Alto Networks

Why it matters now

Fix Fixed hickory-resolver (crates.io): 0.26.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—hickory-resolver (crates.io)0.26.0-beta.1 to before 0.26.20.26.2Patch availableGHSA-6w6g-hm98-mhgm
  • hickory-resolver (crates.io) Vendor— Affected 0.26.0-beta.1 to before 0.26.2 Fixed in 0.26.2 Patch available GHSA-6w6g-hm98-mhgm

Remediation

  • Fix · GHSA-6w6g-hm98-mhgm hickory-resolver (crates.io) Fixed in 0.26.2 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from GHSA-6w6g-hm98-mhgm

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences