CVE-2026-123589: Security vulnerability

Published Nov 8, 2026

Updated

The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely, consuming server resources and causing a denial of service.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-server (hickory-dns) to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Deployments running hickory-server before 0.26.2 with the DNS-over-QUIC server enabled are exposed. The issue affects the DoQ request-reading path; the provided information does not establish impact on other DNS transports.

What does an attacker need to exploit the issue?

An attacker only needs remote network access to the DoQ service and does not need to authenticate. They can open a QUIC connection and request stream, then keep the stream open without completing the request.

Do configured server timeouts mitigate this issue?

No. The vulnerable DoQ request-message read does not apply a timeout, which bypasses configured timeouts for this operation.

What can be done if upgrading is not immediately possible?

The provided information identifies the exposed service as DNS-over-QUIC. Restricting remote access to the DoQ service can reduce exposure while an upgrade to 0.26.2 or later is planned.

CVE-2026-123589: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What does an attacker need to exploit the issue?

Do configured server timeouts mitigate this issue?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What does an attacker need to exploit the issue?

Do configured server timeouts mitigate this issue?

What can be done if upgrading is not immediately possible?