Read the docs
TI-2026-86730 Aliases CVE-2026-123588GHSA-mhgq-ww4c-c9h8

Denial of service in Hickory DNS recursive resolver via empty pool

Priority MEDIUM 53CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

All versions of the hickory-recursor crate and hickory-resolver from 0.26.0 before 0.26.2 are affected. The recursive resolver caches an empty connection pool when it follows a referral with no glue records and all lookups of the name servers' IP addresses fail (CWE-754). An attacker able to spoof DNS responses can make these lookups fail, so all later queries for the affected zone fail until the cache entry expires or is evicted.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

The recursive resolver in Hickory DNS (all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2) caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS responses can make these lookups fail, causing all subsequent queries for the affected zone to fail until the cache entry expires or is evicted.

Why it matters now

Fix Fixed hickory-dns (hickory-dns): 0.26.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
hickory-dnshickory-dnsup to 0.26.0-alpha.1—No fix listedCNA
hickory-dnshickory-dns0.26.0 to before 0.26.20.26.2Patch availableCNA
  • hickory-dns Vendorhickory-dns Affected up to 0.26.0-alpha.1 Fixed in — No fix listed CNA
  • hickory-dns Vendorhickory-dns Affected 0.26.0 to before 0.26.2 Fixed in 0.26.2 Patch available CNA

Remediation

Update hickory-resolver to version 0.26.2. The sources list no fixed version for hickory-recursor.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA hickory-dns (hickory-dns) Fixed in 0.26.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hickory-dns 0.26.2

    36 records Highest priority Priority MEDIUM 36 MEDIUM

    Other records, highest priority first

    • TI-2026-86729 DNSSEC nonexistence forgery in Hickory DNS via wraparound NSECPriority MEDIUM 54
    • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referralsPriority MEDIUM 53
    • TI-2026-86747 DNSSEC validation bypass in Hickory DNS via RRSIG signer namePriority MEDIUM 53
    Show all 36 records →

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-123588
  2. 2026-11-08 Alias added: GHSA-mhgq-ww4c-c9h8

References

Advisory 1

  • TI-2025-18857 DNSSEC validation may accept broken authentication chains CVSS 4.0MEDIUM 5.7
  • TI-2026-86729 DNSSEC nonexistence forgery in Hickory DNS via wraparound NSEC CVSS 4.0HIGH 8.9
  • TI-2026-86750 CPU exhaustion in Hickory DNS hickory-proto via BinEncoder name compression CVSS 4.0HIGH 8.7
  • TI-2026-86749 Hickory DNS NSEC3 validation loop enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referrals CVSS 4.0HIGH 8.7
  • TI-2026-86747 DNSSEC validation bypass in Hickory DNS via RRSIG signer name CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences