CVE-2026-123585: Security vulnerability

Published Nov 8, 2026

Updated

The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the hickory-resolver component in Hickory DNS versions from 0.25.0 before 0.26.2 are affected when they perform recursive DNS resolution.

What does an attacker need to exploit it?

An attacker needs control over DNS responses seen by the resolver. They can place irrelevant CNAME records in authority or additional sections, or outside the original query name's CNAME chain, to trigger unnecessary follow-up queries.

What is the practical impact of exploitation?

The resolver can issue excess DNS queries that are not needed to answer the original request. This increases query amplification and can consume resolver and upstream DNS resources.

How can I tell whether a resolver is being affected?

Inspect recursive-resolution traffic for follow-up queries caused by CNAME records that are unrelated to the requested name's CNAME chain, including records supplied in authority or additional response sections.

CVE-2026-123585: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of exploitation?

How can I tell whether a resolver is being affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of exploitation?

How can I tell whether a resolver is being affected?