CVE-2026-123604: Security vulnerability

Published Nov 8, 2026

Updated

Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::trysend, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-dns/hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using hickory-resolver versions from 0.26.0-beta.1 before 0.26.2 are affected when they query a malicious authoritative DNS server that repeatedly returns truncated responses.

What must an attacker be able to do to trigger resource exhaustion?

An attacker needs to operate, or otherwise cause the resolver to query, an authoritative server that returns TC=1 on every transport. The repeated truncated responses keep the resolver retrying over a persistent TCP connection until the 5-second request deadline.

How can I determine whether a resolver is being affected?

Look for requests that remain active for approximately the 5-second deadline while repeatedly handling truncated DNS responses from the same authoritative server over a persistent TCP connection. Affected behavior consists of retries being re-queued without an iteration limit or transport check.

CVE-2026-123604: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to trigger resource exhaustion?

How can I determine whether a resolver is being affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to trigger resource exhaustion?

How can I determine whether a resolver is being affected?