Denial of Service Issue in Hickory DNS by Hickory Inc.
CVE-2026-123584

8.2HIGH

Key Information:

Vendor

Hickory-dns

Status
Hickory-dns
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123584?

The hickory-net crate in Hickory DNS versions prior to 0.26.2 is susceptible to a denial of service attack. This occurs when an attacker can guess the source port of a client UDP connection. They can then spoof malformed responses which cause client queries to abort due to the inability to parse DNS messages, ultimately leading to service disruption.

Affected Version(s)

hickory-dns 0.26.0 < 0.26.2

hickory-dns 0.26.2

References

https://github.com/hickory-dns/hickory-dns/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/hickory-dns-0.26.0-b...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

qifan-sailboat
.