UBUNTU-CVE-2026-123589: Medium severity ubuntu/rust-hickory-server vulnerability

Published Nov 9, 2026

Updated

The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely, consuming server resources and causing a denial of service.

Affected Software

2 affected components

ubuntu/rust-hickory-server*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-server (hickory-dns) to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 9, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments running the DNS-over-QUIC server component in hickory-server are affected when using a version before 0.26.2.

Does an attacker need credentials or user interaction?

No. A remote unauthenticated client can exploit the issue by opening a QUIC connection and request stream.

Do configured timeouts mitigate this issue?

No. The affected request-message read path does not apply a timeout, bypassing configured timeouts and allowing the stream to remain open indefinitely.