PT-2026-139885

CVE-2026-123604

Published

2026-10-05

Updated

2026-11-08

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hickory DNS hickory-resolver versions 0.26.0-beta.1 through 0.26.1

Description An unbounded retry loop exists in the try send() function of NameServerPool. This occurs when the resolver re-queues truncated (TC) responses without verifying the answering transport or tracking the number of iterations. A malicious authoritative server can trigger this by returning a TC=1 flag on every transport, forcing the resolver to maintain a persistent TCP connection until the 5-second request deadline expires, leading to resource exhaustion.

Recommendations Update Hickory DNS hickory-resolver to version 0.26.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption

CWE-406: Insufficient Control of Network Message Volume (Network Amplification)

CWE-835: Loop with Unreachable Exit Condition (\'Infinite Loop\')