CVE-2026-123604
Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop
CVE-2026-123604 is a high vulnerability (CVSS 8.7) in Hickory-dns, published September 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in hickory-resolver 0.26.2.
- Severity
- 8.7 HighCVSS 4.0, CVE List
- Exploit chance
- 0.34%EPSS, 28th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.26.2hickory-resolver +5 more
Description
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hickory-resolvercrates.io | 0.26.0-beta.1 up to 0.26.2 | 0.26.2 |
rust-hickory-resolverDebian:13 | All versions, plus listed versions 0.24.4-10.24.4-20.24.4-30.24.4-40.24.4-5 Show 4 moreShow less0.25.2-10.25.2-20.26.1-10.26.3-1 | None known |
rust-hickory-resolverDebian:14 | before 0.26.3-1, plus listed versions 0.24.4-10.24.4-20.24.4-30.24.4-40.24.4-50.25.2-10.25.2-20.26.1-1 | 0.26.3-1 |
rust-hickory-resolverUbuntu:24.04:LTS | All versions, plus listed versions 0.24.0-1 | None known |
rust-hickory-resolverUbuntu:26.10 | All versions, plus listed versions 0.24.4-50.26.1-1 | None known |
rust-hickory-resolverUbuntu:26.04:LTS | All versions, plus listed versions 0.24.4-10.24.4-5 | None known |
What each source reports
CVE List Score used
Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
- Record
CVE-2026-123604- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-08
EUVDEUVD-2026-119363
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
- Record
EUVD-2026-119363- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-08
GitHub AdvisoriesGHSA-6w6g-hm98-mhgm
hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)
When the hickory-resolver name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets TC=1 on every available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.
Reporter
Qifan Zhang, Palo Alto Networks
- Record
GHSA-6w6g-hm98-mhgm- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400, CWE-406, CWE-835
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9rhf-mg7m-qfr9
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in...
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
- Record
GHSA-9rhf-mg7m-qfr9- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-08
NVD
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
- Record
CVE-2026-123604- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-12
OSV
Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
- Record
CVE-2026-123604- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-835
- Updated
- 2026-11-12
Show 4 moreShow less
OSVDEBIAN-CVE-2026-123604
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
- Record
DEBIAN-CVE-2026-123604- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-13
OSVGHSA-6w6g-hm98-mhgm
hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)
When the hickory-resolver name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets TC=1 on every available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.
Reporter
Qifan Zhang, Palo Alto Networks
- Record
GHSA-6w6g-hm98-mhgm- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400, CWE-406, CWE-835
- Updated
- 2026-11-12
OSVUBUNTU-CVE-2026-123604
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.
- Record
UBUNTU-CVE-2026-123604- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
OSVRUSTSEC-2026-0513No score
Unbounded retries on truncated responses in the name server pool
When an upstream answer had the TC (truncated) bit set, the resolver's name server pool disabled UDP and sent the query again. It did this for every truncated answer, including answers that already came over TCP, and it kept no count of retries.
A name server that sets TC on every answer, which anyone running an authoritative server the resolver queries can do, kept each lookup re-sending queries over the same connection until the request deadline (5 seconds by default) ran out. This uses up resolver resources and sends many queries per lookup.
From 0.26.2 a truncated answer received after UDP has already been disabled ends the lookup with NetError::Truncated instead of retrying again.
- Record
RUSTSEC-2026-0513- Updated
- 2026-11-12
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, published, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, cwes, facts, published, references | NVD, OSV | |
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories | |
| aliases, published | EUVD | |
| first indexed | CVE List | |
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm
vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-resource-exhaustion-dos-via-nameserverpool-try-send-tc-retry-loop
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-123604
security-tracker.debian.org/tracker/CVE-2026-123604
crates.io/crates/hickory-resolver
rustsec.org/advisories/RUSTSEC-2026-0513.html
ubuntu.com/security/CVE-2026-123604
cve.org/CVERecord?id=CVE-2026-123604