Description
Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.
Published: 2026-11-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Resource Exhaustion (Denial of Service)
Action: Immediate Patch
AI Analysis

Impact

A memory exhaustion flaw exists in Hickory DNS versions 0.24.0 through 0.26.1 that allows an attacker to send large DNS-over-QUIC length prefixes without completing the request body, causing pre‑allocated buffers to remain allocated indefinitely and eventually consume all available server memory.

Affected Systems

Hickory DNS is a recursion resolver library built in Rust, and the affected revisions are 0.24.0, 0.25.x, and 0.26.1. Any deployment that uses one of these versions and accepts DNS-over-QUIC traffic is potentially vulnerable.

Risk and Exploitability

The vulnerability scores a CVSS of 8.7, indicating high severity, and the EPSS is not available. Because the flaw is triggered purely through externally sent QUIC packets, no user interaction is required. An attacker can initiate a large number of concurrent connections, each allocating a buffer that will not be released, leading to rapid depletion of server memory and eventual denial of service, with no authentication or special privileges needed. The vulnerability is not currently listed in the CISA KEV catalog, but its high score and potential impact warrant swift remediation.

Generated by OpenCVE AI on November 8, 2026 at 03:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Hickory DNS to a version newer than 0.26.1 that includes the memory‑exhaustion fix.
  • If the deployment supports it, disable DNS-over-QUIC or strictly limit the rate of QUIC connections to the resolver.
  • Configure server‑side request timeouts and hard memory limits to prevent prolonged allocation of resources during incomplete QUIC requests.

Generated by OpenCVE AI on November 8, 2026 at 03:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 01:45:00 +0000

Type Values Removed Values Added
Description Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.
Title Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-08T01:38:11.970Z

Reserved: 2026-11-06T00:55:55.660Z

Link: CVE-2026-123576

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-08T02:16:50.780

Modified: 2026-11-08T02:16:50.780

Link: CVE-2026-123576

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T03:15:08Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling