CVE-2026-123575: Security vulnerability

Published Nov 8, 2026

Updated

Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Hickory DNS deployments using the DNS-over-HTTPS HTTP/2 server are exposed if they run a version before 0.26.2. The provided information does not identify any other affected service mode.

What must an attacker do to trigger the resource exhaustion?

An attacker must be able to establish DNS-over-HTTPS connections to the server and send incomplete HTTP/2 request bodies. They can hold those connections open, consuming server memory.

What version resolves the issue?

Upgrade Hickory DNS to version 0.26.2 or later. The affected range is versions before 0.26.2.

CVE-2026-123575: Security vulnerability

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the resource exhaustion?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the resource exhaustion?

What version resolves the issue?