CVE-2026-123586High· 7.5▾ TwilightHickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name se…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.
hickory-dns >= 0.25.0-alpha.3 <= 0.25.2hickory-dns < 0.26.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123570High· 7.5Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts
CVE-2026-123585Medium· 5.3Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records
CVE-2026-123606High· 7.5Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification
CVE-2026-123576High· 7.5Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests
CVE-2026-123571High· 7.5Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding
CVE-2026-123572High· 7.5Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser