CVE-2026-123606

The hickory-dns recursor (specifically hickory-recursor versions 0.25.0-alpha.3 through 0.25.2 and hickory-resolver versions 0.26.0-alpha.1 before 0.26.2) is vulnerable to a Referral Amplification attack. The root cause is that the recursor iterates through every out-of-bailiwick NS target lackin...

CVE-2026-123606 Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification

The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookup...