DEBIAN-CVE-2026-123576: High severity debian/rust-hickory-dns vulnerability

Published Nov 8, 2026

Updated

Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.

Affected Software

2 affected components

debian/rust-hickory-dns*

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Hickory DNS versions 0.24.0 through 0.26.1 that accept DNS-over-QUIC requests are exposed. The affected Debian package is rust-hickory-dns.

What does an attacker need to exploit it?

An attacker needs network access to the DNS-over-QUIC service. No privileges or user interaction are required; the attacker can open many connections and send incomplete request bodies containing large length prefixes.

What is the impact of a successful attack?

Pre-allocated buffers can remain in memory without a timeout, allowing repeated incomplete requests to exhaust server memory. This can cause a denial of service.

DEBIAN-CVE-2026-123576: High severity debian/rust-hickory-dns vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of a successful attack?