Denial of Service in Hickory DNS Recursive Resolver by Vendor Hickory

CVE-2026-123588

What is CVE-2026-123588?

The recursive resolver in Hickory DNS can be exploited to cause a denial of service through improper cache management. When the resolver encounters a referral without glue records and fails to retrieve the IP addresses of the name servers, it caches an empty connection pool. This can allow an attacker to spoof DNS responses, leading to persistent lookup failures. As a result, subsequent queries for the affected zone will be disrupted until the cache entry is either purged or expires, significantly impacting the availability of services that rely on the affected DNS functionality.

References