GHSA-g8wg-4mwh-fjfv: Hickory DNS before 0.26.2 Denial of Service via Missing DNS-over-QUIC Request Read Timeout

Published Nov 8, 2026

Updated

The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely, consuming server resources and causing a denial of service.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-server (hickory-dns) to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

Deployments using the DNS-over-QUIC server in hickory-server (hickory-dns) before version 0.26.2 are affected. The issue concerns request-message reads from QUIC streams.

What does an attacker need to do to exploit it?

A remote unauthenticated client only needs to open a QUIC connection and request stream, then keep that stream open without completing the request. This can consume server resources indefinitely and lead to denial of service.

Do configured timeouts mitigate the issue?

No. The missing timeout on DNS-over-QUIC request reads bypasses all configured timeouts for that operation.

What version resolves the issue?

Upgrade hickory-server (hickory-dns) to version 0.26.2 or later.

GHSA-g8wg-4mwh-fjfv: Hickory DNS before 0.26.2 Denial of Service via Missing DNS-over-QUIC Request Read Timeout

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What does an attacker need to do to exploit it?

Do configured timeouts mitigate the issue?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What does an attacker need to do to exploit it?

Do configured timeouts mitigate the issue?

What version resolves the issue?