{"id":"CVE-2026-123604","aliases":["DEBIAN-CVE-2026-123604","EUVD-2026-119363","GHSA-6w6g-hm98-mhgm","GHSA-9rhf-mg7m-qfr9","UBUNTU-CVE-2026-123604"],"status":"published","title":"Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop","description":"Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00343,"percentile":0.28238,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-406","CWE-835"],"published":"2026-10-05T22:55:10Z","modified":"2026-11-10T02:50:13Z","fixes":[{"ecosystem":"crates.io","package":"hickory-resolver","fixed_in":["0.26.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"rust-hickory-resolver","fixed_in":["0.26.3-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1","0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-5","0.25.2-1","0.25.2-2","0.26.1-1","0.26.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.3-1"}]}],"versions":["0.24.4-1","0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-5","0.25.2-1","0.25.2-2","0.26.1-1"]},{"source":"osv","ecosystem":"crates.io","package":"hickory-resolver","ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-5","0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hickory-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-1","0.24.4-5"]}],"products":[{"vendor":"hickory-dns","product":"hickory-dns"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm","tags":["vendor-advisory","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-resource-exhaustion-dos-via-nameserverpool-try-send-tc-retry-loop","tags":["third-party-advisory","advisory","report"]},{"url":"https://github.com/hickory-dns/hickory-dns/pull/3871","tags":["web"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/0848d2e9e4183499343318a690d6dd5e48bc21c1","tags":["web"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/5d37e2e04a36a87013a213b58b820345ef76a263","tags":["web"]},{"url":"https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6w6g-hm98-mhgm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123604","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9rhf-mg7m-qfr9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123604.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123604","tags":["advisory"]},{"url":"https://github.com/hickory-dns/hickory-dns","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-123604","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123604","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123604","title":"Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop","description":"Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.","status":"published","published":"2026-11-08T01:38:31.351Z","modified":"2026-11-08T01:38:31.351Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-08T02:36:49.037074Z"}],"euvd":[{"id":"EUVD-2026-119363","description":"Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.","status":"published","published":"2026-11-08T01:38:31Z","modified":"2026-11-08T01:38:31Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T06:12:04.155226Z"}],"ghsa":[{"id":"GHSA-6w6g-hm98-mhgm","title":"hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)","description":"When the `hickory-resolver` name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets `TC=1` on **every** available transport  keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.\n\n### Reporter\n\nQifan Zhang, Palo Alto Networks","status":"published","published":"2026-10-05T22:55:10Z","modified":"2026-10-05T22:55:12Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-406","CWE-835"],"updated_at":"2026-11-02T14:41:27.036917Z"},{"id":"GHSA-9rhf-mg7m-qfr9","title":"Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in...","description":"Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.","status":"published","published":"2026-11-08T03:30:37Z","modified":"2026-11-08T03:30:44Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-08T03:41:54.072675Z"}],"nvd":[{"id":"CVE-2026-123604","description":"Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.","status":"published","published":"2026-11-08T02:16:55.273Z","modified":"2026-11-10T22:15:59.797Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-08T07:09:05.855788Z"}],"osv":[{"id":"CVE-2026-123604","title":"Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop","description":"Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.","status":"published","published":"2026-11-08T01:38:31.351Z","modified":"2026-11-09T02:47:17.646698282Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"DEBIAN-CVE-2026-123604","description":"Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.","status":"published","published":"2026-11-08T02:16:55.273Z","modified":"2026-11-11T09:47:48.992241915Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-08T16:07:04.53493Z"},{"id":"GHSA-6w6g-hm98-mhgm","title":"hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)","description":"When the `hickory-resolver` name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets `TC=1` on **every** available transport  keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.\n\n### Reporter\n\nQifan Zhang, Palo Alto Networks","status":"published","published":"2026-10-05T22:55:10Z","modified":"2026-11-08T10:56:09.807310548Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-406","CWE-835"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"UBUNTU-CVE-2026-123604","description":"Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T02:50:13.272143361Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-10T03:18:58.105788Z"}]}}