DEBIAN-CVE-2026-123575: High severity debian/rust-hickory-dns vulnerability

Q: Which deployments are exposed to this issue?

Deployments of Hickory DNS before 0.26.2 that run its DNS-over-HTTPS HTTP/2 server are exposed. The affected Debian package is debian/rust-hickory-dns.

Q: What does an attacker need to do to trigger the denial of service?

An unauthenticated remote attacker needs network access to the DNS-over-HTTPS service. They can open DoH connections, provide incomplete request bodies, and keep those connections open to consume server memory.

Q: Is user interaction or prior access required?

No. The reported vector is network-based, with low attack complexity, no privileges required, and no user interaction required.

Q: What is the impact of successful exploitation?

Successful exploitation can exhaust server memory and cause a denial of service. The supplied severity vector indicates no reported confidentiality or integrity impact.

Published Nov 8, 2026

Updated

Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-dns*

debian/rust-hickory-dns<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-dns to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments of Hickory DNS before 0.26.2 that run its DNS-over-HTTPS HTTP/2 server are exposed. The affected Debian package is debian/rust-hickory-dns.

What does an attacker need to do to trigger the denial of service?

An unauthenticated remote attacker needs network access to the DNS-over-HTTPS service. They can open DoH connections, provide incomplete request bodies, and keep those connections open to consume server memory.

Is user interaction or prior access required?

No. The reported vector is network-based, with low attack complexity, no privileges required, and no user interaction required.

What is the impact of successful exploitation?

Successful exploitation can exhaust server memory and cause a denial of service. The supplied severity vector indicates no reported confidentiality or integrity impact.

DEBIAN-CVE-2026-123575: High severity debian/rust-hickory-dns vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Is user interaction or prior access required?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

Is user interaction or prior access required?

What is the impact of successful exploitation?