CVE-2026-123606: Security vulnerability
The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review deployments using hickory-recursor versions 0.25.0-alpha.3 through 0.25.2, or hickory-resolver versions 0.26.0-alpha.1 before 0.26.2. The issue affects recursive DNS processing of referrals containing out-of-bailiwick NS targets without glue.
What capability does an attacker need?
An attacker must be able to serve a crafted DNS referral to the recursor. The referral needs multiple out-of-bailiwick NS targets lacking glue, causing A and AAAA lookups for each target.
How can this be exploited operationally?
Exploitation can amplify DNS traffic directed at remote servers or consume resources on the affected recursor. The described behavior has no per-query work budget for iterating the qualifying NS targets.