- Reported
-
- Issued
-
- Package
-
hickory-resolver
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#dns
#recursor
#amplification
- Aliases
-
- References
-
- Patched
-
- Unaffected
-
Description
Two zones can each delegate to name servers named only inside the other zone, with no glue records (the cyclic sibling case in RFC 9471 section 2.3). Such delegations can never be resolved, but the recursor did not stop when it came back to a zone it was already resolving. It kept sending queries until the per-request limits ran out, and zero TTLs on the referral NS records made this worse.
Someone who controls two such zones can make a recursor send many upstream queries for each client query.
This affects the recursive resolver, which is in hickory-resolver behind the opt-in recursor feature from 0.26.0-beta.1. Earlier releases shipped it as the separate hickory-recursor crate.
From 0.26.2 each client request tracks the zones on its resolution stack and refuses to enter a zone that is already on it.
Advisory available under CC0-1.0
license.