What is CVE-2026-123588?

CVE-2026-123588 is a high-severity vulnerability in Hickory-Dns, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 7.5/10. Published 2026-11-08.

How severe is CVE-2026-123588?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Hickory-Dns

CVE-2026-123588

The recursive resolver in Hickory DNS (all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2) caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS responses can make these lookups fail, causing all subsequent queries for the affected zone to fail until the cache entry expires or is evicted.

Published 2026-11-08.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Hickory-Dns

Weakness classification (CWE)

CWE-754 — Improper Check for Unusual or Exceptional Conditions

References

github.com/hickory-dns/hickory-dns/security/advisories/GHSA-9px7-7m25-f6q2 (vendor-advisory)
www.vulncheck.com/advisories/hickory-dns-recursive-resolver-denial-of-service-v… (third-party-advisory)

Frequently asked questions

What is CVE-2026-123588?: CVE-2026-123588 is a high-severity vulnerability in Hickory-Dns, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 7.5/10. Published 2026-11-08.
How severe is CVE-2026-123588?: High severity. CVSS v3 base score is 7.5 out of 10.