DEBIAN-CVE-2026-123585: Medium severity debian/rust-hickory-resolver vulnerability

Q: Who is exposed to this issue?

Resolvers using the hickory-resolver component in Hickory DNS versions from 0.25.0 before 0.26.2 are exposed when they perform recursive DNS queries and process attacker-controlled DNS responses.

Q: What does an attacker need to exploit it?

An attacker needs to control DNS responses seen by the resolver. They can place irrelevant CNAME records in the authority or additional sections, or outside the queried name's CNAME chain, to trigger unnecessary follow-up queries.

Q: What is the practical impact?

The resolver can send excess DNS queries that are not needed to answer the original request, increasing query amplification and potentially causing an availability impact.

Q: How can I tell whether my resolver is affected?

Check whether the deployed resolver uses hickory-resolver from Hickory DNS 0.25.0 through versions earlier than 0.26.2, and whether it performs recursive resolution.

Published Nov 8, 2026

Updated

The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-resolver*

debian/rust-hickory-resolver<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Resolvers using the hickory-resolver component in Hickory DNS versions from 0.25.0 before 0.26.2 are exposed when they perform recursive DNS queries and process attacker-controlled DNS responses.

What does an attacker need to exploit it?

An attacker needs to control DNS responses seen by the resolver. They can place irrelevant CNAME records in the authority or additional sections, or outside the queried name's CNAME chain, to trigger unnecessary follow-up queries.

What is the practical impact?

The resolver can send excess DNS queries that are not needed to answer the original request, increasing query amplification and potentially causing an availability impact.

How can I tell whether my resolver is affected?

Check whether the deployed resolver uses hickory-resolver from Hickory DNS 0.25.0 through versions earlier than 0.26.2, and whether it performs recursive resolution.

DEBIAN-CVE-2026-123585: Medium severity debian/rust-hickory-resolver vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact?

How can I tell whether my resolver is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact?

How can I tell whether my resolver is affected?