DEBIAN-CVE-2026-123604: High severity debian/rust-hickory-resolver vulnerability

Q: Who is exposed to this issue?

Deployments using Hickory DNS hickory-resolver versions from 0.26.0-beta.1 through before 0.26.2 are exposed when they can query a malicious authoritative DNS server.

Q: What does an attacker need to do to trigger the resource exhaustion?

An attacker-controlled authoritative server must return a truncated DNS response with the TC bit set on every transport. This causes the resolver to repeatedly re-queue the response over a persistent TCP connection until the five-second request deadline.

Q: Is authentication or user interaction required for exploitation?

No. The reported vector is network-based, with low attack complexity and no privileges or user interaction required.

Q: How can I tell whether a resolver is being affected?

Affected requests can remain in a retry loop for the five-second request deadline while communicating with an authoritative server that repeatedly returns TC=1. This behavior can consume resolver resources and contribute to availability impact.

Published Nov 8, 2026

Updated

Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::trysend, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-resolver*

debian/rust-hickory-resolver<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Deployments using Hickory DNS hickory-resolver versions from 0.26.0-beta.1 through before 0.26.2 are exposed when they can query a malicious authoritative DNS server.

What does an attacker need to do to trigger the resource exhaustion?

An attacker-controlled authoritative server must return a truncated DNS response with the TC bit set on every transport. This causes the resolver to repeatedly re-queue the response over a persistent TCP connection until the five-second request deadline.

Is authentication or user interaction required for exploitation?

No. The reported vector is network-based, with low attack complexity and no privileges or user interaction required.

How can I tell whether a resolver is being affected?

Affected requests can remain in a retry loop for the five-second request deadline while communicating with an authoritative server that repeatedly returns TC=1. This behavior can consume resolver resources and contribute to availability impact.

DEBIAN-CVE-2026-123604: High severity debian/rust-hickory-resolver vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the resource exhaustion?

Is authentication or user interaction required for exploitation?

How can I tell whether a resolver is being affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the resource exhaustion?

Is authentication or user interaction required for exploitation?

How can I tell whether a resolver is being affected?