Denial of Service in Hickory DNS Server by Unauthenticated Client
CVE-2026-123589

6.9MEDIUM

Key Information:

Vendor

Hickory-dns

Status
Hickory-dns
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123589?

The Hickory DNS server, specifically versions prior to 0.26.2, suffers from a vulnerability in its DNS-over-QUIC implementation. This flaw allows a remote unauthenticated client to establish a connection and maintain an open request stream indefinitely. Without the application of proper timeout mechanisms, the server’s resources can be exhausted, leading to denial of service for legitimate users. The absence of restrictions on request handling presents a significant risk to the stability and availability of the service.

Affected Version(s)

hickory-dns 0 < 0.26.2

hickory-dns 0.26.2

References

https://github.com/hickory-dns/hickory-dns/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/hickory-dns-before-0...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

N0zoM1z0
.