Unbounded Retry Loop Vulnerability in Hickory DNS Resolver by Hickory

CVE-2026-123604

What is CVE-2026-123604?

The Hickory DNS resolver prior to version 0.26.2 contains a vulnerability characterized by an unbounded retry loop in the NameServerPool::try_send function. This issue allows a malicious authoritative server to send truncated responses, which causes the resolver to endlessly re-queue these responses. Without proper transport validation or iteration counting, the resolver remains engaged on a persistent TCP connection, leading to significant resource exhaustion when the request deadline is reached.

References