UBUNTU-CVE-2026-123576: High severity ubuntu/rust-hickory-dns vulnerability
Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Hickory DNS versions 0.24.0 through 0.26.1 that accept DNS-over-QUIC requests are exposed. The issue is remotely reachable over the network and requires no attacker privileges or user interaction.
What must an attacker do to exhaust memory?
An attacker can open many DNS-over-QUIC connections and send incomplete request bodies containing only large length prefixes. This causes pre-allocated buffers to remain allocated without a timeout, allowing memory consumption to grow until server resources are exhausted.
What is the operational impact?
The reported impact is denial of service through server memory exhaustion. No confidentiality or integrity impact is indicated by the provided severity vector.