Unbounded Loop Vulnerability in Hickory DNS from Hickory Corp

CVE-2026-123607

What is CVE-2026-123607?

Hickory DNS versions 0.25.0-alpha.3 through 0.25.2 and hickory-net prior to 0.26.1 are susceptible to an unbounded loop vulnerability stemming from improper validation within the DnssecDnsHandle NSEC3 closest-encloser proof. Attackers can exploit this by returning NoData or NXDomain responses alongside a cross-zone SOA record, potentially leading to panic in debug builds or memory exhaustion in production environments. It is crucial for users of affected versions to implement protective measures or upgrades to mitigate the risk associated with this vulnerability.

References