hickory-dns vulnerabilities and CVEs

Known vulnerabilities affecting hickory-dns, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

39 vulnerabilities tracked.

8.9 The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next… CVE-2026-123587 8 Nov 2026
8.7 Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to… CVE-2026-123608 8 Nov 2026
8.7 Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in… CVE-2026-123607 8 Nov 2026
8.7 The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every… CVE-2026-123606 8 Nov 2026
8.7 Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator… CVE-2026-123605 8 Nov 2026
8.7 Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::trysend, which re-queues… CVE-2026-123604 8 Nov 2026
8.7 Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the… CVE-2026-123595 8 Nov 2026
8.7 Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the… CVE-2026-123596 8 Nov 2026
8.7 The recursive resolver in Hickory DNS (all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2) caches an… CVE-2026-123588 8 Nov 2026
8.7 Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic… CVE-2026-123586 8 Nov 2026
8.7 Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record… CVE-2026-123580 8 Nov 2026
8.7 Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory… CVE-2026-123577 8 Nov 2026
8.7 Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts… CVE-2026-123575 8 Nov 2026
8.7 Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by… CVE-2026-123576 8 Nov 2026
8.7 The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes… CVE-2026-123574 8 Nov 2026
8.7 hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation… CVE-2026-123573 8 Nov 2026
8.7 Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation… CVE-2026-123572 8 Nov 2026
8.7 Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to… CVE-2026-123571 8 Nov 2026
8.7 The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted… CVE-2026-123570 8 Nov 2026
8.3 Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the… CVE-2026-123601 8 Nov 2026
8.2 The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is… CVE-2026-123602 8 Nov 2026
8.2 The hickory-net crate in Hickory DNS 0.26.0-beta.1 before 0.26.2 allows DNSSEC validation bypass because Name's Hash ignores label lengths… CVE-2026-123592 8 Nov 2026
8.2 Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 fail to verify, per RFC 6840 §4.4, that an… CVE-2026-123591 8 Nov 2026
8.2 The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a… CVE-2026-123584 8 Nov 2026
6.9 hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3… CVE-2026-123603 8 Nov 2026
6.9 The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from… CVE-2026-123589 8 Nov 2026
6.9 The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries,… CVE-2026-123585 8 Nov 2026
6.9 Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts… CVE-2026-123581 8 Nov 2026
6.3 Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in… CVE-2026-123600 8 Nov 2026
6.3 The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and… CVE-2026-123598 8 Nov 2026
6.3 Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verifyrrsets()… CVE-2026-123599 8 Nov 2026
6.3 Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's… CVE-2026-123597 8 Nov 2026
6.3 Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a… CVE-2026-123594 8 Nov 2026
6.3 Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against… CVE-2026-123593 8 Nov 2026
6.3 Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC… CVE-2026-123590 8 Nov 2026
6.3 The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the… CVE-2026-123582 8 Nov 2026
6.3 The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply… CVE-2026-123583 8 Nov 2026
6.3 DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish… CVE-2026-123579 8 Nov 2026
6.3 Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section… CVE-2026-123578 8 Nov 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that hickory-dns is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Other products tracked here