DEBIAN-CVE-2026-123584: Medium severity debian/rust-hickory-net vulnerability

Q: Who is exposed to this denial-of-service condition?

Systems using the hickory-net crate as part of Hickory DNS are exposed when they make UDP DNS queries. The affected Debian package is debian/rust-hickory-net.

Q: What does an attacker need to exploit it?

An attacker must be able to send spoofed UDP responses and correctly guess the source port of an active client query. Knowledge of the DNS transaction ID is not required, but the attack complexity is rated high.

Q: What is the impact of a successful attack?

A malformed spoofed response can cause the client to stop listening and return an error, aborting the DNS query. The stated impact is denial of service, with no confidentiality or integrity impact indicated.

Q: Which versions are affected?

Hickory DNS 0.26.0 before 0.26.2 is affected according to the available information.

Published Nov 8, 2026

Updated

The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.

Affected Software

1 affected componentFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this denial-of-service condition?

Systems using the hickory-net crate as part of Hickory DNS are exposed when they make UDP DNS queries. The affected Debian package is debian/rust-hickory-net.

What does an attacker need to exploit it?

An attacker must be able to send spoofed UDP responses and correctly guess the source port of an active client query. Knowledge of the DNS transaction ID is not required, but the attack complexity is rated high.

What is the impact of a successful attack?

A malformed spoofed response can cause the client to stop listening and return an error, aborting the DNS query. The stated impact is denial of service, with no confidentiality or integrity impact indicated.

Which versions are affected?

Hickory DNS 0.26.0 before 0.26.2 is affected according to the available information.

DEBIAN-CVE-2026-123584: Medium severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service condition?

What does an attacker need to exploit it?

What is the impact of a successful attack?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service condition?

What does an attacker need to exploit it?

What is the impact of a successful attack?

Which versions are affected?