DEBIAN-CVE-2026-123577: High severity debian/rust-hickory-server vulnerability

Q: Which deployments are exposed to this issue?

Deployments running Hickory DNS versions from 0.24.0 before 0.26.2 that provide DNS over HTTP are exposed. The affected Debian package is rust-hickory-server.

Q: What does an attacker need to exploit it?

An attacker only needs network access to the DNS over HTTP service. They can send oversized request bodies over HTTP/2 or HTTP/3; no privileges or user interaction are required.

Q: What is the practical impact?

Large DoH request bodies can cause unbounded server memory consumption, resulting in memory exhaustion and denial of service. The available data does not indicate confidentiality or integrity impact.

Q: What can be done if upgrading is not immediately possible?

The provided data identifies the affected request paths as DoH over HTTP/2 and HTTP/3, but does not specify a documented workaround or configuration mitigation. Prioritize limiting exposure of the DNS over HTTP service until an upgrade is possible.

Published Nov 8, 2026

Updated

Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. Attackers can send large request bodies over HTTP/2 or HTTP/3 to a DNS over HTTP server, causing memory exhaustion and denial of service.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-server*

debian/rust-hickory-server<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-server to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments running Hickory DNS versions from 0.24.0 before 0.26.2 that provide DNS over HTTP are exposed. The affected Debian package is rust-hickory-server.

What does an attacker need to exploit it?

An attacker only needs network access to the DNS over HTTP service. They can send oversized request bodies over HTTP/2 or HTTP/3; no privileges or user interaction are required.

What is the practical impact?

Large DoH request bodies can cause unbounded server memory consumption, resulting in memory exhaustion and denial of service. The available data does not indicate confidentiality or integrity impact.

What can be done if upgrading is not immediately possible?

The provided data identifies the affected request paths as DoH over HTTP/2 and HTTP/3, but does not specify a documented workaround or configuration mitigation. Prioritize limiting exposure of the DNS over HTTP service until an upgrade is possible.

DEBIAN-CVE-2026-123577: High severity debian/rust-hickory-server vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact?

What can be done if upgrading is not immediately possible?