CVE-2026-123588

Name of the Vulnerable Software and Affected Versions hickory-recursor (affected versions not specified) hickory-resolver versions 0.26.0 through 0.26.1

Description The recursive resolver caches an empty connection pool when following a referral that lacks glue records (DNS records that provide the IP address of a name server) and all queries for the name servers' IP addresses fail. An attacker capable of spoofing DNS responses can trigger these lookup failures, resulting in a denial of service where all subsequent queries for the affected zone fail until the cache entry expires or is evicted.

Recommendations Update hickory-resolver to version 0.26.2 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for the hickory-recursor crate.