Memory Exhaustion Vulnerability in Hickory DNS by Hickory

CVE-2026-123576

What is CVE-2026-123576?

A memory exhaustion vulnerability exists in Hickory DNS versions 0.24.0 through 0.26.1. This flaw allows attackers to exploit the DNS-over-QUIC protocol by sending large-length prefixes within incomplete request bodies. By opening multiple connections, they can prevent pre-allocated memory buffers from timing out, resulting in the exhaustion of server resources and potential denial of service. Organizations using the affected versions are encouraged to apply mitigations and update their installations promptly.

References