UBUNTU-CVE-2026-123588: High severity ubuntu/rust-hickory-resolver vulnerability
The recursive resolver in Hickory DNS (all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2) caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS responses can make these lookups fail, causing all subsequent queries for the affected zone to fail until the cache entry expires or is evicted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The resolver must follow a referral that has no glue records, and every query to obtain the referred name servers' IP addresses must fail. An attacker must be able to spoof DNS responses to cause those lookup failures.
What is the operational impact after a successful attack?
The resolver caches an empty connection pool for the affected zone. Subsequent queries for that zone fail until the cache entry expires or is evicted.
Which components are affected?
All versions of the hickory-recursor crate are affected. For hickory-resolver, versions 0.26.0 before 0.26.2 are affected.
What can clear the failure state if an update cannot be applied immediately?
The affected zone will recover when the cached entry expires or is evicted. The provided information does not specify a manual mitigation or configuration workaround.