{"id":"CVE-2026-123585","aliases":["DEBIAN-CVE-2026-123585","EUVD-2026-119344","GHSA-6f2x-v7q7-m7m5","GHSA-qw4x-w9jf-pmv6","UBUNTU-CVE-2026-123585"],"status":"published","title":"Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records","description":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00304,"percentile":0.23523,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-10-05T22:55:18Z","modified":"2026-11-10T02:50:13Z","fixes":[{"ecosystem":"crates.io","package":"hickory-resolver","fixed_in":["0.26.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"rust-hickory-resolver","fixed_in":["0.26.3-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.25.0"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1","0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-5","0.25.2-1","0.25.2-2","0.26.1-1","0.26.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.3-1"}]}],"versions":["0.24.4-1","0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-5","0.25.2-1","0.25.2-2","0.26.1-1"]},{"source":"osv","ecosystem":"crates.io","package":"hickory-resolver","ranges":[{"type":"SEMVER","events":[{"introduced":"0.25.0"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-5","0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1","0.24.4-5"]}],"products":[{"vendor":"hickory-dns","product":"hickory-dns"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5","tags":["vendor-advisory","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-query-amplification-via-irrelevant-cname-records","tags":["third-party-advisory","advisory","report"]},{"url":"https://github.com/hickory-dns/hickory-dns/pull/3871","tags":["web"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/4689fc8d3ddd3e3f99ec1b7be4e2e9e78afd2e6b","tags":["web"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/ccd6952378f250c714fc2af0cb1053e1c179f832","tags":["web"]},{"url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6f2x-v7q7-m7m5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123585","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qw4x-w9jf-pmv6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123585.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123585","tags":["advisory"]},{"url":"https://github.com/hickory-dns/hickory-dns","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-123585","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123585","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123585","title":"Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records","description":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.","status":"published","published":"2026-11-08T01:38:18.261Z","modified":"2026-11-10T17:57:43.009Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-08T02:36:49.037074Z"}],"euvd":[{"id":"EUVD-2026-119344","description":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.","status":"published","published":"2026-11-08T01:38:18Z","modified":"2026-11-10T17:57:43Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-08T06:12:04.155226Z"}],"ghsa":[{"id":"GHSA-6f2x-v7q7-m7m5","title":"hickory-resolver follows irrelevant CNAME records","description":"When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.","status":"published","published":"2026-10-05T22:55:18Z","modified":"2026-10-05T22:55:20Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:41:27.036917Z"},{"id":"GHSA-qw4x-w9jf-pmv6","title":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME...","description":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.","status":"published","published":"2026-11-08T03:30:35Z","modified":"2026-11-08T03:30:44Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-08T03:41:54.072675Z"}],"nvd":[{"id":"CVE-2026-123585","description":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.","status":"published","published":"2026-11-08T02:16:52.327Z","modified":"2026-11-10T22:15:59.797Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-10T20:21:09.207118Z"}],"osv":[{"id":"CVE-2026-123585","title":"Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records","description":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.","status":"published","published":"2026-11-08T01:38:18.261Z","modified":"2026-11-12T02:30:53.668148845Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"DEBIAN-CVE-2026-123585","description":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.","status":"published","published":"2026-11-08T02:16:52.327Z","modified":"2026-11-11T10:00:53.636085747Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-11T10:35:16.464644Z"},{"id":"GHSA-6f2x-v7q7-m7m5","title":"hickory-resolver follows irrelevant CNAME records","description":"When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.","status":"published","published":"2026-10-05T22:55:18Z","modified":"2026-11-08T10:56:17.173884253Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"UBUNTU-CVE-2026-123585","description":"The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T02:50:13.857808368Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-10T03:18:58.105788Z"}]}}