EUVD-2026-119344Published
Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-123585 · CVE overview and exploitation status
cve-program · CVE-2026-123585
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
- https://www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-query-amplification-via-irrelevant-cname-records
euvd · EUVD-2026-119344
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
- https://www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-query-amplification-via-irrelevant-cname-records
nvd · CVE-2026-123585
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
- https://www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-query-amplification-via-irrelevant-cname-records
osv · GHSA-6f2x-v7q7-m7m5
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
- https://github.com/hickory-dns/hickory-dns/pull/3871
- https://github.com/hickory-dns/hickory-dns/commit/4689fc8d3ddd3e3f99ec1b7be4e2e9e78afd2e6b
- https://github.com/hickory-dns/hickory-dns/commit/ccd6952378f250c714fc2af0cb1053e1c179f832
- https://github.com/hickory-dns/hickory-dns
- https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
Related changes
Linked by CVE identifier- The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses c… · Advisory content revised · 12 Nov 2026
- Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records · Newly collected advisory · 8 Nov 2026
- hickory-resolver follows irrelevant CNAME records · Advisory content revised · 8 Nov 2026