UBUNTU-CVE-2026-123584: High severity ubuntu/rust-hickory-net vulnerability
Published Nov 9, 2026
·Updated
The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.
Affected Software
1 affected component
ubuntu/rust-hickory-net*
Event History
Nov 9, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which versions require remediation?
The issue affects Hickory DNS 0.26.0 through versions before 0.26.2. Upgrading to 0.26.2 or later addresses the affected version range.
2
What information does an attacker need to mount the denial-of-service attack?
An attacker needs to guess the source port of the client query. They do not need to know the DNS transaction ID.