{"id":"CVE-2026-123586","title":"Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals","summary":"Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name se…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-400"],"vendor":"hickory-dns","product":"hickory-dns","affected":["hickory-dns >= 0.25.0-alpha.3 <= 0.25.2","hickory-dns < 0.26.2"],"published":"2026-11-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T01:38:18.937Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123586","references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756","label":"GitHub Security Advisory (GHSA-cx5j-p54p-q756)"},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.25.0-alpha.3-through-0.25.2-query-amplification-via-cyclic-referrals","label":"VulnCheck Advisory: Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals"}],"tags":["cve.org"],"ingestedAt":"2026-11-08T02:43:18.655Z","slug":"CVE-2026-123586","body":"## Overview\n\nHickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.\n\n## Affected\n\n- `hickory-dns >= 0.25.0-alpha.3 <= 0.25.2`\n- `hickory-dns < 0.26.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}