UBUNTU-CVE-2026-123577: High severity ubuntu/rust-hickory-server vulnerability
Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. Attackers can send large request bodies over HTTP/2 or HTTP/3 to a DNS over HTTP server, causing memory exhaustion and denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
DNS over HTTP servers using Hickory DNS versions 0.24.0 through versions before 0.26.2 are exposed when they accept DoH requests. The vulnerable component is packaged as ubuntu/rust-hickory-server.
What does an attacker need to exploit the vulnerability?
An attacker only needs network access to the DNS over HTTP service. They can submit large request bodies over HTTP/2 or HTTP/3; no authentication or user interaction is required.
What is the practical impact of successful exploitation?
Large unbounded DoH request bodies can cause the server to consume memory until it is exhausted. This can deny service to the affected DNS server.