- Reported
-
- Issued
-
- Package
-
hickory-recursor
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#dns
#recursor
#amplification
- Aliases
-
- References
-
- Patched
-
no patched versions
- Unaffected
-
Description
Two zones can each delegate to name servers named only inside the other zone, with no glue records (RFC 9471 section 2.3). The recursor did not stop when it came back to a zone it was already resolving, so someone who controls two such zones can make it send many upstream queries for each client query.
The recursor code moved into hickory-resolver (opt-in recursor feature) in 0.26.0-beta.1, and the fix is in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should move to hickory-resolver 0.26.2 or later with the recursor feature.
Advisory available under CC0-1.0
license.