---
id: CVE-2026-123586
title: >-
  Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic
  Referrals
summary: >-
  Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification
  vulnerability in its recursive resolver, which mishandles cyclic sibling name
  server referrals that lack glue records. Attackers controlling two zones whose
  name se…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
vendor: hickory-dns
product: hickory-dns
affected:
  - hickory-dns >= 0.25.0-alpha.3 <= 0.25.2
  - hickory-dns < 0.26.2
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:18.937Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123586'
references:
  - url: >-
      https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756
    label: GitHub Security Advisory (GHSA-cx5j-p54p-q756)
  - url: >-
      https://www.vulncheck.com/advisories/hickory-dns-0.25.0-alpha.3-through-0.25.2-query-amplification-via-cyclic-referrals
    label: >-
      VulnCheck Advisory: Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query
      Amplification via Cyclic Referrals
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.655Z'
---

## Overview

Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.

## Affected

- `hickory-dns >= 0.25.0-alpha.3 <= 0.25.2`
- `hickory-dns < 0.26.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.