DEBIAN-CVE-2026-123586: High severity debian/rust-hickory-recursor vulnerability

Q: What must an attacker control to trigger the amplification?

The attacker must control two DNS zones whose name servers refer to each other and omit glue records. Zero-TTL NS records can further amplify the resulting upstream query volume.

Q: Which deployments are exposed?

Deployments using the Hickory recursive resolver functionality in the affected version range are exposed. The issue is in recursive resolution behavior, so systems not performing recursive resolution are not identified as affected by the available data.

Q: What is the operational impact?

Cyclic sibling name server referrals can cause the recursor to loop and issue many upstream DNS queries. This can lead to a denial-of-service condition through amplified query traffic.

Published Nov 8, 2026

Updated

Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.

Affected Software

4 affected componentsFixes available

debian/rust-hickory-recursor*

debian/rust-hickory-resolver*

debian/rust-hickory-resolver<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker control to trigger the amplification?

The attacker must control two DNS zones whose name servers refer to each other and omit glue records. Zero-TTL NS records can further amplify the resulting upstream query volume.

Which deployments are exposed?

Deployments using the Hickory recursive resolver functionality in the affected version range are exposed. The issue is in recursive resolution behavior, so systems not performing recursive resolution are not identified as affected by the available data.

What is the operational impact?

Cyclic sibling name server referrals can cause the recursor to loop and issue many upstream DNS queries. This can lead to a denial-of-service condition through amplified query traffic.

DEBIAN-CVE-2026-123586: High severity debian/rust-hickory-recursor vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker control to trigger the amplification?

Which deployments are exposed?

What is the operational impact?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to trigger the amplification?

Which deployments are exposed?

What is the operational impact?