Read the docs
TI-2026-86718 Aliases CVE-2026-123576GHSA-ch84-jp3r-9q25

Memory exhaustion in Hickory DNS via DNS-over-QUIC requests

Priority MEDIUM 53CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Hickory DNS from 0.24.0 through 0.26.1 contains a resource exhaustion flaw in its DNS-over-QUIC handling, where it allocates buffers based on request length prefixes without limits (CWE-770). A remote, unauthenticated attacker can open many connections and send only large length prefixes, so the pre-allocated buffers persist without timeout and exhaust server memory.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.

Why it matters now

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
hickory-dnshickory-dns0.24.0 – 0.26.1—No fix listedCNA
  • hickory-dns Vendorhickory-dns Affected 0.24.0 – 0.26.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for hickory-dns.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-123576
  2. 2026-11-08 Alias added: GHSA-ch84-jp3r-9q25

References

Advisory 1

  • TI-2025-18857 DNSSEC validation may accept broken authentication chains CVSS 4.0MEDIUM 5.7
  • TI-2026-86729 DNSSEC nonexistence forgery in Hickory DNS via wraparound NSEC CVSS 4.0HIGH 8.9
  • TI-2026-86750 CPU exhaustion in Hickory DNS hickory-proto via BinEncoder name compression CVSS 4.0HIGH 8.7
  • TI-2026-86749 Hickory DNS NSEC3 validation loop enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referrals CVSS 4.0HIGH 8.7
  • TI-2026-86747 DNSSEC validation bypass in Hickory DNS via RRSIG signer name CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences