CVE-2026-123586

Name of the Vulnerable Software and Affected Versions Hickory DNS versions 0.25.0-alpha.3 through 0.25.2

Description The recursive resolver mishandles cyclic sibling name server referrals that lack glue records. Glue records are additional DNS data provided to resolve a name server's hostname. An attacker controlling two zones with name servers that reference each other without these records can cause the recursor to enter a loop, resulting in a high volume of upstream queries. This effect is further amplified by zero-TTL (Time to Live) NS records, which prevent the resolver from caching the result.

Recommendations Update Hickory DNS versions 0.25.0-alpha.3 through 0.25.2 to a newer version that contains a fix for this issue.