{"id":"CVE-2026-123586","aliases":["RUSTSEC-2026-0516","GHSA-cx5j-p54p-q756","RUSTSEC-2026-0522"],"title":"Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals","titleSource":"VulnCheck","descriptionSource":"OSV","description":"Two zones can each delegate to name servers named only inside the other zone, with no glue records (the cyclic sibling case in RFC 9471 section 2.3). Such delegations can never be resolved, but the recursor did not stop when it came back to a zone it was already resolving. It kept sending queries until the per-request limits ran out, and zero TTLs on the referral NS records made this worse.\n\nSomeone who controls two such zones can make a recursor send many upstream queries for each client query.\n\nThis affects the recursive resolver, which is in hickory-resolver behind the opt-in `recursor` feature from 0.26.0-beta.1. Earlier releases shipped it as the separate hickory-recursor crate.\n\nFrom 0.26.2 each client request tracks the zones on its resolution stack and refuses to enter a zone that is already on it.","severity":"high","score":8.7,"published":"2026-09-03T12:00:00.000Z","modified":"2026-11-12T14:40:46.104Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"crates.io","name":"hickory-resolver","sources":[{"name":"OSV · RUSTSEC-2026-0516","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0516"}],"ranges":[{"events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.2"]},{"ecosystem":"crates.io","name":"hickory-recursor","sources":[{"name":"OSV · RUSTSEC-2026-0522","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0522"}],"ranges":[{"events":[{"introduced":"0.25.0-alpha.3"}],"type":"SEMVER"}],"versions":[],"fixed":[]}],"sourceAffected":[],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756","https://www.vulncheck.com/advisories/hickory-dns-0.25.0-alpha.3-through-0.25.2-query-amplification-via-cyclic-referrals","https://crates.io/crates/hickory-resolver","https://rustsec.org/advisories/RUSTSEC-2026-0516.html","https://github.com/hickory-dns/hickory-dns/commit/308dcfd5cd9bfaa50c956427380160505e5de532","https://crates.io/crates/hickory-recursor","https://rustsec.org/advisories/RUSTSEC-2026-0522.html"],"sources":[{"name":"CVE","id":"CVE-2026-123586","modified":"2026-11-09T13:54:36.684Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123586"},{"name":"OSV","id":"RUSTSEC-2026-0516","modified":"2026-11-12T14:40:46.104677262Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0516"},{"name":"OSV","id":"RUSTSEC-2026-0522","modified":"2026-11-12T14:40:46.104677262Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0522"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"cve":{"records":[{"id":"CVE-2026-123586","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:57:31.044Z","published":"2026-11-08T01:38:18.937Z","modified":"2026-11-09T13:54:36.684Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:38:18.937Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T13:54:36.684Z"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.25.0-alpha.3-through-0.25.2-query-amplification-via-cyclic-referrals","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-400","description":"Uncontrolled Resource Consumption","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T13:54:27.883535Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.25.0-alpha.3","status":"affected","lessThanOrEqual":"0.25.2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-recursor","packageIdentity":{"ecosystem":"crates.io","name":"hickory-recursor"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123586"},{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.26.2","versionType":"semver"},{"version":"0.26.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-resolver","packageIdentity":{"ecosystem":"crates.io","name":"hickory-resolver"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123586"}],"remediation":[],"observedAt":"2026-11-12T21:52:49.356Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:55:30.737Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T02:25:40.931Z","attemptedAt":"2026-11-08T02:25:40.931Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T02:25:39.960Z","attemptedAt":"2026-11-08T02:25:39.960Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-08T02:25:41.381Z","attemptedAt":"2026-11-08T02:25:41.381Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T02:25:41.599Z","attemptedAt":"2026-11-08T02:25:41.599Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-123586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123586","modified":"2026-11-08T02:16:52.477","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T02:25:40.931Z"},{"source":"NVD","id":"CVE-2026-123586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123586","modified":"2026-11-08T02:16:52.477","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-08T02:25:40.931Z"}],"aiSummary":{"text":"Hickory DNS versions 0.25.0-alpha.3 through 0.25.2 are affected by a query amplification vulnerability via cyclic referrals. An attacker with control over two zones can cause the recursor to send many upstream queries. This affects the recursive resolver in hickory-resolver and hickory-recursor crates.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T04:01:09.519Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123586"},{"name":"OSV","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0516"},{"name":"OSV","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0522"}]}}