Summary
hickory-resolver follows irrelevant CNAME records
Advisory details
When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.
References
- https://github.com/advisories/GHSA-6f2x-v7q7-m7m5
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
- https://github.com/hickory-dns/hickory-dns/pull/3871
- https://github.com/hickory-dns/hickory-dns/commit/4689fc8d3ddd3e3f99ec1b7be4e2e9e78afd2e6b
- https://github.com/hickory-dns/hickory-dns/commit/ccd6952378f250c714fc2af0cb1053e1c179f832
- https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts
- MEDIUMCVE-2026-100350
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
- MEDIUMCVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
- MEDIUMCVE-2026-104150
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
- HIGHCVE-2026-72923
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
- HIGHCVE-2026-107805
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage