Description
Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. Attackers can send large request bodies over HTTP/2 or HTTP/3 to a DNS over HTTP server, causing memory exhaustion and denial of service.
Published: 2026-11-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via memory exhaustion
Action: Update
AI Analysis

Impact

The vulnerability in Hickory DNS allows remote attackers to consume server memory by sending unbounded DNS over HTTPS request bodies. By transmitting large payloads over HTTP/2 or HTTP/3, an attacker can trigger memory exhaustion, leading to service degradation or a complete denial of service. The weakness is a case of uncontrolled resource consumption represented by CWE-770.

Affected Systems

The vulnerability affects the hickory-dns product from the hickory-dns vendor. Versions starting at 0.24.0 and up through 0.26.1 are impacted. Users running any of these releases should consider the risk.

Risk and Exploitability

With a CVSS score of 8.7, this issue is high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue. Attackers would need network access to the DNS over HTTPS endpoint and can exploit the flaw by crafting oversized DoH requests over HTTP/2 or HTTP/3. No local privilege escalation or code execution is required; the impact is limited to denial of service on the affected server.

Generated by OpenCVE AI on November 8, 2026 at 03:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Hickory DNS to version 0.26.2 or later.
  • If an upgrade is not possible, configure your firewall or load balancer to reject DoH requests with bodies exceeding a safe threshold.
  • Disable or restrict HTTP/2 and HTTP/3 support for DNS over HTTPS unless required for your environment.
  • Monitor DNS server CPU and memory usage for abnormal spikes that may indicate exploitation attempts.

Generated by OpenCVE AI on November 8, 2026 at 03:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 01:45:00 +0000

Type Values Removed Values Added
Description Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. Attackers can send large request bodies over HTTP/2 or HTTP/3 to a DNS over HTTP server, causing memory exhaustion and denial of service.
Title Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-08T01:38:12.696Z

Reserved: 2026-11-06T00:55:55.660Z

Link: CVE-2026-123577

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-08T02:16:51.050

Modified: 2026-11-08T02:16:51.050

Link: CVE-2026-123577

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T03:45:15Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling