DEBIAN-CVE-2026-123589: Medium severity debian/rust-hickory-server vulnerability

Q: Which deployments are exposed to this denial-of-service issue?

Deployments running hickory-server before 0.26.2 with the DNS-over-QUIC server reachable by remote clients are exposed. The affected software is Debian's rust-hickory-server package.

Q: What must an attacker do to trigger the issue?

No authentication or user interaction is required. A remote client can open a QUIC connection and request stream, then keep that stream open indefinitely while the server waits for a request message.

Q: Are configured server timeouts sufficient to prevent this?

No. The affected DoQ request-message read does not apply a timeout, so it bypasses configured timeouts.

Q: What is the available remediation?

Upgrade hickory-server to version 0.26.2 or later. The provided information does not identify an alternative mitigation if upgrading cannot occur immediately.

Published Nov 8, 2026

Updated

The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely, consuming server resources and causing a denial of service.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-server*

debian/rust-hickory-server<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-server to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade hickory-server (hickory-dns) to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Deployments running hickory-server before 0.26.2 with the DNS-over-QUIC server reachable by remote clients are exposed. The affected software is Debian's rust-hickory-server package.

What must an attacker do to trigger the issue?

No authentication or user interaction is required. A remote client can open a QUIC connection and request stream, then keep that stream open indefinitely while the server waits for a request message.

Are configured server timeouts sufficient to prevent this?

No. The affected DoQ request-message read does not apply a timeout, so it bypasses configured timeouts.

What is the available remediation?

Upgrade hickory-server to version 0.26.2 or later. The provided information does not identify an alternative mitigation if upgrading cannot occur immediately.

DEBIAN-CVE-2026-123589: Medium severity debian/rust-hickory-server vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What must an attacker do to trigger the issue?

Are configured server timeouts sufficient to prevent this?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What must an attacker do to trigger the issue?

Are configured server timeouts sufficient to prevent this?

What is the available remediation?