GHSA-2f4m-fq7w-mrgx: Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests

Published Nov 8, 2026

Updated

Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Hickory DNS deployments running versions 0.24.0 through 0.26.1 are exposed when they accept DNS-over-QUIC requests. The described attack targets the server-side handling of incomplete DNS-over-QUIC request bodies.

What does an attacker need to do to trigger the memory exhaustion?

A remote attacker can open many DNS-over-QUIC connections and send large length prefixes without completing the request bodies. This causes pre-allocated buffers to remain allocated without a timeout, eventually consuming server memory.

Can this be mitigated operationally before an update is available?

The provided information identifies DNS-over-QUIC request handling as the affected path, but does not specify a documented workaround. Limiting or disabling exposure to DNS-over-QUIC would remove the described attack vector if that is feasible for the deployment.

GHSA-2f4m-fq7w-mrgx: Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

Can this be mitigated operationally before an update is available?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

Can this be mitigated operationally before an update is available?