{"id":"CVE-2026-123606","aliases":["RUSTSEC-2026-0515","GHSA-6h5c-jjg5-wj59","RUSTSEC-2026-0521"],"title":"Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification","titleSource":"VulnCheck","descriptionSource":"OSV","description":"When a referral listed name servers outside the delegated zone and gave no glue addresses, the recursor looked up A and AAAA records for every listed name server, recursing into each one. Only the chain-depth limits applied. There was no cap on how many name servers it chased per referral or on the total upstream work per client query.\n\nSomeone who controls a zone can return referrals that list many glueless name servers in a victim's domain, and nest them, so that each client query makes the recursor send a large number of queries to the victim's servers (the NXNSAttack pattern). The same can exhaust the recursor's own resources.\n\nThis affects the recursive resolver, which is in hickory-resolver behind the opt-in `recursor` feature from 0.26.0-beta.1. Earlier releases shipped it as the separate hickory-recursor crate.\n\nFrom 0.26.2 the recursor follows at most 5 glueless name servers per delegation and sends at most 200 upstream queries per client request.","severity":"high","score":8.7,"published":"2026-09-03T12:00:00.000Z","modified":"2026-11-12T14:40:53.913Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"crates.io","name":"hickory-resolver","sources":[{"name":"OSV · RUSTSEC-2026-0515","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0515"}],"ranges":[{"events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.2"]},{"ecosystem":"crates.io","name":"hickory-recursor","sources":[{"name":"OSV · RUSTSEC-2026-0521","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0521"}],"ranges":[{"events":[{"introduced":"0.25.0-alpha.3"}],"type":"SEMVER"}],"versions":[],"fixed":[]}],"sourceAffected":[],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6h5c-jjg5-wj59","https://www.vulncheck.com/advisories/hickory-dns-recursor-0.25.0-alpha.3-through-0.25.2-glueless-ns-referral-amplification","https://crates.io/crates/hickory-resolver","https://rustsec.org/advisories/RUSTSEC-2026-0515.html","https://github.com/hickory-dns/hickory-dns/commit/74062f3a3ef6904b64717dd025945702b2cf4133","https://github.com/hickory-dns/hickory-dns/commit/47cd005b8f3d190134bbb943d2328ef8a83ade8c","https://crates.io/crates/hickory-recursor","https://rustsec.org/advisories/RUSTSEC-2026-0521.html"],"sources":[{"name":"CVE","id":"CVE-2026-123606","modified":"2026-11-09T13:52:33.572Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123606"},{"name":"OSV","id":"RUSTSEC-2026-0515","modified":"2026-11-12T14:40:53.913632545Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0515"},{"name":"OSV","id":"RUSTSEC-2026-0521","modified":"2026-11-12T14:40:53.913632545Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0521"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"cve":{"records":[{"id":"CVE-2026-123606","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T01:02:39.794Z","published":"2026-11-08T01:38:32.727Z","modified":"2026-11-09T13:52:33.572Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:38:32.727Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T13:52:33.572Z"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6h5c-jjg5-wj59","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/hickory-dns-recursor-0.25.0-alpha.3-through-0.25.2-glueless-ns-referral-amplification","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-400","description":"Uncontrolled Resource Consumption","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T13:52:24.658971Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.25.0-alpha.3","status":"affected","lessThanOrEqual":"0.25.2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-recursor","packageIdentity":{"ecosystem":"crates.io","name":"hickory-recursor"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123606"},{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.26.0-alpha.1","status":"affected","lessThan":"0.26.2","versionType":"semver"},{"version":"0.26.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-resolver","packageIdentity":{"ecosystem":"crates.io","name":"hickory-resolver"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123606"}],"remediation":[],"observedAt":"2026-11-12T21:52:45.784Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:55:30.737Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-08T02:00:40.620Z","attemptedAt":"2026-11-08T02:00:40.620Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T02:00:33.014Z","attemptedAt":"2026-11-08T02:00:33.014Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-08T02:00:32.744Z","attemptedAt":"2026-11-08T02:00:32.744Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T02:00:33.341Z","attemptedAt":"2026-11-08T02:00:33.341Z"}],"evidence":[],"aiSummary":{"text":"Hickory-DNS Recursor versions 0.25.0-alpha.3 through 0.25.2 are affected by an uncontrolled resource consumption weakness. An attacker with control over a zone can cause the recursor to send a large number of queries, potentially exhausting its resources.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T04:01:06.820Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123606"},{"name":"OSV","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0515"},{"name":"OSV","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0521"}]}}