---
id: CVE-2026-123585
title: >-
  Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME
  Records
summary: >-
  The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows
  irrelevant CNAME records when resolving recursive queries, sending queries
  that are unnecessary to answer the original request. Attackers controlling DNS
  response…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-400
vendor: hickory-dns
product: hickory-dns
affected:
  - hickory-dns >= 0.25.0 < 0.26.2
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:18.261Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123585'
references:
  - url: >-
      https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
    label: GitHub Security Advisory (GHSA-6f2x-v7q7-m7m5)
  - url: >-
      https://www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-query-amplification-via-irrelevant-cname-records
    label: >-
      VulnCheck Advisory: Hickory DNS 0.25.0 before 0.26.2 Query Amplification
      via Irrelevant CNAME Records
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.654Z'
---

## Overview

The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.

## Affected

- `hickory-dns >= 0.25.0 < 0.26.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.