All vulnerabilities
GHSA-6f2x-v7q7-m7m5

hickory-resolver follows irrelevant CNAME records

hickory-resolverrustLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.26.2Fixed versionGitHub
Published5 Oct 2026Updated 5 Oct 2026GitHub

What fixes it

  • 0.26.2hickory-resolver, rustGitHub
  • 0.26.2hickory-resolver, crates.ioOSVcargo update -p hickory-resolver --precise 0.26.2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.

Text from GitHub Advisory Database

Affected versions 2

  • hickory-resolver, rust>= 0.25.0, < 0.26.2GitHub
  • hickory-resolver, crates.iofrom 0.25.0, fixed in 0.26.2OSV

References 6