GHSA-v44v-c8m4-gc43: Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses

Published Nov 8, 2026

Updated

The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Deployments using the hickory-net crate in Hickory DNS versions 0.26.0 through before 0.26.2 are affected when they make client UDP queries. An attacker can target those queries remotely by sending spoofed responses.

What must an attacker know to disrupt a query?

The attacker must guess the source port used by the client query. The transaction ID does not need to be known, but the spoofed response must contain a datagram that cannot be parsed as a DNS message.

What happens when exploitation succeeds?

The affected UDP client connection stops listening and returns an error. This aborts client queries and can cause a denial of service.

GHSA-v44v-c8m4-gc43: Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses

Event History

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What must an attacker know to disrupt a query?

What happens when exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What must an attacker know to disrupt a query?

What happens when exploitation succeeds?