Query Amplification Vulnerability in Hickory DNS Recursive Resolver

CVE-2026-123586

What is CVE-2026-123586?

The Hickory DNS versions from 0.25.0-alpha.3 to 0.25.2 present a query amplification vulnerability in its recursive resolver. This issue arises when the resolver mishandles cyclic sibling name server referrals that do not include glue records. Attackers exploiting this flaw can control two zones where the name servers refer to each other. Without the necessary glue records, this condition leads to a recursion loop in the resolver, resulting in an excessive number of upstream queries. The impact is further exacerbated when zero-TTL NS records are involved, causing significant amplification of the traffic generated by the resolver, potentially disrupting service.

References