Reported

September 3, 2026

Issued

November 12, 2026

Package

hickory-resolver (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#dns #recursor #nxnsattack #amplification

Aliases

• CVE-2026-123606
• GHSA-6h5c-jjg5-wj59

References

• https://github.com/hickory-dns/hickory-dns/commit/74062f3a3ef6904b64717dd025945702b2cf4133
• https://github.com/hickory-dns/hickory-dns/commit/47cd005b8f3d190134bbb943d2328ef8a83ade8c

Patched

• >=0.26.2

Unaffected

• <0.26.0-beta.1

Description

When a referral listed name servers outside the delegated zone and gave no glue addresses, the recursor looked up A and AAAA records for every listed name server, recursing into each one. Only the chain-depth limits applied. There was no cap on how many name servers it chased per referral or on the total upstream work per client query.

Someone who controls a zone can return referrals that list many glueless name servers in a victim's domain, and nest them, so that each client query makes the recursor send a large number of queries to the victim's servers (the NXNSAttack pattern). The same can exhaust the recursor's own resources.

This affects the recursive resolver, which is in hickory-resolver behind the opt-in recursor feature from 0.26.0-beta.1. Earlier releases shipped it as the separate hickory-recursor crate.

From 0.26.2 the recursor follows at most 5 glueless name servers per delegation and sends at most 200 upstream queries per client request.

Advisory available under CC0-1.0 license.