CVE-2026-123606
HighCVSS 7.5Summary
The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.
Risk Assessment
The attack can cause recursor resource exhaustion or traffic amplification against remote servers, threatening availability.
Recommendation
Update hickory-recursor and hickory-resolver to version 0.26.2 or later. Consider limiting per-query work budget and monitoring outbound traffic.
Other vulnerabilities in hickory-recursor
Original NVD description (English source)
The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS