UBUNTU-CVE-2026-123585: Medium severity ubuntu/rust-hickory-resolver vulnerability
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the hickory-resolver component in Hickory DNS versions 0.25.0 before 0.26.2 are affected when they perform recursive DNS resolution. The Ubuntu package identified is rust-hickory-resolver.
What must an attacker be able to do to trigger the behavior?
An attacker must be able to control DNS responses received by the resolver. They can supply irrelevant CNAME records in authority or additional sections, or CNAME records outside the queried name's CNAME chain.
What is the practical impact of exploitation?
The resolver may issue unnecessary follow-up DNS queries that are not needed to answer the original request. This increases query volume and can amplify DNS traffic, affecting availability.