Reported

September 3, 2026

Issued

November 12, 2026

Package

hickory-recursor (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#dns #recursor #nxnsattack #amplification

Aliases

• CVE-2026-123606
• GHSA-6h5c-jjg5-wj59

References

• https://github.com/hickory-dns/hickory-dns/commit/74062f3a3ef6904b64717dd025945702b2cf4133
• https://github.com/hickory-dns/hickory-dns/commit/47cd005b8f3d190134bbb943d2328ef8a83ade8c

Patched

no patched versions

Unaffected

• <0.25.0-alpha.3

Description

For referrals whose name servers are outside the delegated zone and come without glue, the recursor resolved every listed name server, with no cap on referral width and no per-query work budget. Someone who controls a zone can use this to make each client query send a large number of queries to a victim's servers (the NXNSAttack pattern), or to exhaust the recursor.

The recursor code moved into hickory-resolver (opt-in recursor feature) in 0.26.0-beta.1, and the fix is in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should move to hickory-resolver 0.26.2 or later with the recursor feature.

Advisory available under CC0-1.0 license.