Resource exhaustion in Hickory-Dns
CVE-2026-123585
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.
Vulnerability class: DoS (Denial of Service)
Published .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.003 (23.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 23rd percentile — 23.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
Weakness classification (CWE)
References
- github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5 (vendor-advisory)
- www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-query-amplificati… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-123585?
- CVE-2026-123585 is a medium-severity vulnerability in Hickory-Dns, classified under Uncontrolled Resource Consumption. CVSS score: 5.3/10. Published 2026-11-08.
- How severe is CVE-2026-123585?
- Medium severity. CVSS v3 base score is 5.3 out of 10.