UBUNTU-CVE-2026-123586: High severity ubuntu/rust-hickory-resolver vulnerability
Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.
Affected Software
Event History
Frequently Asked Questions
What conditions must an attacker meet to trigger the amplification?
The attacker must control two DNS zones whose name servers refer to each other and omit glue records. Zero-TTL NS records can further increase the number of upstream queries generated by the recursive resolver.
Which deployments are exposed?
Deployments using the Hickory recursive resolver in versions 0.25.0-alpha.3 through 0.25.2 are affected. The issue concerns recursive resolution behavior when processing cyclic sibling name-server referrals without glue records.
What is the operational impact of exploitation?
A successful attack can cause the recursor to loop and issue many amplified upstream DNS queries. This can result in a denial-of-service condition.