hickory-resolver follows irrelevant CNAME records
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-400.
Summary
The hickory-resolver crate, from 0.25.0 before 0.26.2, follows CNAME records that are not needed to answer a recursive query. Records in the authority or additional section, and CNAMEs outside a chain starting at the original query name, trigger extra queries. An attacker can use this to amplify DNS query traffic beyond what the recursive query requires, which is a case of uncontrolled resource consumption (CWE-400).
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the GitHub advisory
When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | hickory-resolver (crates.io) | 0.25.0 to before 0.26.2 | 0.26.2 | Patch available | GHSA-6f2x-v7q7-m7m5 |
- hickory-resolver (crates.io) Vendor— Affected 0.25.0 to before 0.26.2 Fixed in 0.26.2 Patch available GHSA-6f2x-v7q7-m7m5
Remediation
Upgrade hickory-resolver to version 0.26.2 or later, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · GHSA-6f2x-v7q7-m7m5 hickory-resolver (crates.io) Fixed in 0.26.2 Advisory →
Timeline
- 2026-10-06 Threatist record created from GHSA-6f2x-v7q7-m7m5
References
Other 6
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
- https://github.com/hickory-dns/hickory-dns/pull/3871
- https://github.com/hickory-dns/hickory-dns/commit/4689fc8d3ddd3e3f99ec1b7be4e2e9e78afd2e6b
- https://github.com/hickory-dns/hickory-dns/commit/ccd6952378f250c714fc2af0cb1053e1c179f832
- https://github.com/hickory-dns/hickory-dns
- https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences