CVE-2026-123584: Security vulnerability

Published Nov 8, 2026

Updated

The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Hickory DNS deployments using the hickory-net crate in versions 0.26.0 before 0.26.2 are affected when acting as a UDP client and receiving DNS responses.

What does an attacker need to exploit the denial of service?

An attacker must be able to send spoofed malformed UDP responses and guess the source port used by the client query. Knowledge of the DNS transaction ID is not required.

What is the observable impact of a successful attack?

A malformed datagram that cannot be parsed as a DNS message causes the client to stop listening and return an error, aborting the affected client query.

What version resolves the issue?

Upgrade to Hickory DNS 0.26.2 or later. The affected range is 0.26.0 before 0.26.2.

CVE-2026-123584: Security vulnerability

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the denial of service?

What is the observable impact of a successful attack?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the denial of service?

What is the observable impact of a successful attack?

What version resolves the issue?