GHSA-6h5c-jjg5-wj59: Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification

Published Nov 8, 2026

Updated

The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using hickory-recursor versions 0.25.0-alpha.3 through 0.25.2, or hickory-resolver versions 0.26.0-alpha.1 before 0.26.2, are affected.

What must an attacker be able to do?

An attacker must be able to serve a DNS referral containing out-of-bailiwick NS targets that lack glue records. The recursor then performs A and AAAA lookups for every such target.

What is the practical impact?

The behavior can amplify DNS traffic toward remote servers and can exhaust resources on the affected recursor. The lack of a per-query work budget allows the attacker-controlled referral to drive this work.

GHSA-6h5c-jjg5-wj59: Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do?

What is the practical impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do?

What is the practical impact?