UBUNTU-CVE-2026-123604: High severity ubuntu/rust-hickory-resolver vulnerability
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::trysend, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-dns/hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
Which releases are affected?
The issue affects hickory-resolver versions from 0.26.0-beta.1 up to, but not including, 0.26.2.
What does an attacker need to exploit this?
An attacker needs to operate or control an authoritative DNS server that the resolver queries. The server must return truncated responses with TC=1 over every attempted transport; no privileges or user interaction are required.
How long can a malicious response keep a request busy?
The resolver can continue retrying on a persistent TCP connection until the five-second request deadline expires. Repeated requests can therefore consume resolver resources and cause denial of service.