CVE-2026-123585 json
Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records
published last mo. modified yesterday also EUVD-2026-119344 , GHSA-6f2x-v7q7-m7m5
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.
Patch / fix
- crates.io hickory-resolver 0.26.2
- hickory-dns hickory-dns 0.26.2
- rust-hickory-resolver Debian 14 0.26.3-1
debian advisories DEBIAN-CVE-2026-123585
Is CVE-2026-123585 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- yesterday
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | hickory-resolver | >=0.25.0, <0.26.2 |
0.26.2 |
Affected products
- hickory-dns hickory-dns
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/hickory-dns/hickory-dns/pull/3871
web
-
github.com
/hickory-dns/hickory-dns/commit/4689fc8d3ddd3e3f99ec1b7be4e2e9e78afd2e6b
web
-
github.com
/hickory-dns/hickory-dns/commit/ccd6952378f250c714fc2af0cb1053e1c179f832
web
-
github.com
/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
vendor-advisory, web
-
vulncheck.com
/advisories/hickory-dns-0.25.0-before-0.26.2-query-amplification-via-irrelevant-cname-records
third-party-advisory
-
github.com
/hickory-dns/hickory-dns
package
-
github.com
/hickory-dns/hickory-dns/releases/tag/v0.26.2
web
Sources
- CVE List CVE-2026-123585
- GitHub Advisory GHSA-6f2x-v7q7-m7m5
- NVD CVE-2026-123585
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.