GHSA-5r56-v84h-c3w5: Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service
Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. Attackers can send large request bodies over HTTP/2 or HTTP/3 to a DNS over HTTP server, causing memory exhaustion and denial of service.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Hickory DNS deployments running versions from 0.24.0 before 0.26.2 are exposed when they operate a DNS-over-HTTPS server that accepts requests over HTTP/2 or HTTP/3.
What access does an attacker need to trigger the issue?
An attacker can exploit the issue remotely by sending large request bodies to the affected DNS-over-HTTPS server over HTTP/2 or HTTP/3. No further access requirements are stated in the available data.
What is the practical impact of exploitation?
Large unbounded request bodies can consume server memory, potentially exhausting available memory and causing denial of service.