UBUNTU-CVE-2026-123575: High severity ubuntu/rust-hickory-dns vulnerability
Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Hickory DNS's DNS-over-HTTPS HTTP/2 server are exposed. The issue is associated with incomplete HTTP request bodies being accepted without sufficient timeouts or limits.
What does an attacker need to exploit it?
An attacker needs network access to the DNS-over-HTTPS service. No privileges or user interaction are required; the attacker can open connections, send incomplete request bodies, and keep those connections open.
What is the likely impact of exploitation?
An attacker can exhaust server memory by maintaining incomplete DoH request bodies, causing a denial of service. The provided severity vector indicates availability impact, with no stated confidentiality or integrity impact.
What version addresses the vulnerability?
Hickory DNS versions before 0.26.2 are affected. Updating to 0.26.2 or later addresses the affected version range described in the advisory.