UBUNTU-CVE-2026-123606: High severity ubuntu/rust-hickory-resolver vulnerability
The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker must be able to serve a DNS referral containing out-of-bailiwick NS targets that lack glue records. The vulnerable recursor then performs A and AAAA lookups for every such target without a per-query work budget.
What is the practical impact on affected deployments?
The issue can be used remotely without authentication or user interaction to amplify DNS traffic toward remote servers or exhaust resources on the recursor. The stated impact is availability loss; no confidentiality or integrity impact is indicated by the provided vector.
Which versions are affected?
Affected versions are hickory-recursor 0.25.0-alpha.3 through 0.25.2, and hickory-resolver 0.26.0-alpha.1 before 0.26.2.