All vulnerabilities
GHSA-6w6g-hm98-mhgm

hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

hickory-resolverrustLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.26.2Fixed versionGitHub
Published5 Oct 2026Updated 5 Oct 2026GitHub

What fixes it

  • 0.26.2hickory-resolver, rustGitHub
  • 0.26.2hickory-resolver, crates.ioOSVcargo update -p hickory-resolver --precise 0.26.2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

When the hickory-resolver name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets TC=1 on every available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.

Reporter

Qifan Zhang, Palo Alto Networks

Text from GitHub Advisory Database

Affected versions 2

  • hickory-resolver, rust>= 0.26.0-beta.1, < 0.26.2GitHub
  • hickory-resolver, crates.iofrom 0.26.0-beta.1, fixed in 0.26.2OSV

References 6