DEBIAN-CVE-2026-123606: Debian/rust-hickory-resolver vulnerability

Q: Which deployments are exposed to this issue?

Deployments using the hickory-dns recursor in hickory-recursor versions 0.25.0-alpha.3 through 0.25.2, or hickory-resolver versions 0.26.0-alpha.1 before 0.26.2, are affected.

Q: What must an attacker do to trigger the issue?

A remote attacker must be able to serve a DNS referral containing out-of-bailiwick NS targets that lack glue records. The resolver then performs A and AAAA lookups for every such target without a per-query work budget.

Q: What is the practical impact?

The crafted referral can cause amplified DNS traffic toward remote servers or consume recursor resources, potentially causing denial of service.

Q: How can I determine whether an instance may be affected?

Check whether the deployment uses the hickory-dns recursor and its hickory-recursor or hickory-resolver version falls within the affected ranges. Also review whether it processes referrals from remote DNS servers, since exploitation relies on an attacker serving a crafted referral.

Published Nov 8, 2026

Updated

The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-resolver*

debian/rust-hickory-resolver<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the hickory-dns recursor in hickory-recursor versions 0.25.0-alpha.3 through 0.25.2, or hickory-resolver versions 0.26.0-alpha.1 before 0.26.2, are affected.

What must an attacker do to trigger the issue?

A remote attacker must be able to serve a DNS referral containing out-of-bailiwick NS targets that lack glue records. The resolver then performs A and AAAA lookups for every such target without a per-query work budget.

What is the practical impact?

The crafted referral can cause amplified DNS traffic toward remote servers or consume recursor resources, potentially causing denial of service.

How can I determine whether an instance may be affected?

Check whether the deployment uses the hickory-dns recursor and its hickory-recursor or hickory-resolver version falls within the affected ranges. Also review whether it processes referrals from remote DNS servers, since exploitation relies on an attacker serving a crafted referral.

DEBIAN-CVE-2026-123606: Debian/rust-hickory-resolver vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the issue?

What is the practical impact?

How can I determine whether an instance may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the issue?

What is the practical impact?

How can I determine whether an instance may be affected?