A vulnerability in the hickory-net crate of Hickory DNS versions 0.26.0 up to but not including 0.26.2 causes the service to stop listening and return an error when receiving malformed UDP datagrams that cannot be parsed as DNS messages. Attackers who can guess the source port of a query, even without knowing the transaction ID, can send spoofed malformed responses to abort client queries, resulting in denial of service.
Hickory DNS versions 0.25.0 up to but not including 0.26.2 have a vulnerability in the hickory-resolver component where irrelevant CNAME records are followed during recursive DNS queries. This causes the resolver to send unnecessary queries, potentially leading to query amplification. The flaw does not impact confidentiality or integrity but can cause availability issues due to increased query load.
Hickory DNS (hickory-server) versions 0.25.0 up to but not including 0.26.2 have a vulnerability in their validating recursive resolver and validating forwarder. They fail to verify that the SOA record included in NXDOMAIN or NODATA responses has passed DNSSEC validation. This flaw allows an attacker who can supply forged DNS responses to cause clients to receive a forged SOA record with the AD bit set, potentially misleading clients that depend on DNSSEC validation.
A vulnerability in the recursive resolver of Hickory DNS affects all versions of the hickory-recursor crate and hickory-resolver versions before 0.26.2. The resolver caches an empty connection pool when it encounters a referral without glue records and all IP address queries for the name servers fail. An attacker capable of spoofing DNS responses can exploit this to cause lookup failures for the affected zone until the cache entry expires or is evicted.
A vulnerability in the DNS-over-QUIC (DoQ) server component of hickory-server (hickory-dns) before version 0.26.2 allows remote unauthenticated clients to open a connection and keep a request stream open indefinitely. This occurs because the server does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. This can lead to resource exhaustion and denial of service on the affected server.
A vulnerability in the hickory-net crate of Hickory DNS versions 0.26.0-beta.1 up to but not including 0.26.2 allows DNSSEC validation bypass. This occurs because the Name's hash function ignores label lengths and the ValidationCacheKey compares only that hash. An attacker controlling an unsigned delegation differing only in dot positions from a signed target can cause an Insecure verdict, leading to forged DNS answers bypassing signature verification.
Hickory DNS versions hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 improperly compare DNSKEY public keys against DNSSEC trust anchors without verifying the DNSKEY record name. This flaw allows an attacker who can spoof or control DNS responses to replace a secure zone's DNSKEY RRset with the root zone's keys and use a large TTL to keep the malicious keys cached.
Hickory DNS versions hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 have an NSEC validation flaw. This flaw causes the software to incorrectly return a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually indicates the name exists as an empty non-terminal. On-path attackers can exploit this to change a genuine signed NODATA response's unsigned rcode from NOERROR to NXDOMAIN, leading validators to accept a forged nonexistence of the queried name.
Hickory DNS versions 0.25.0-alpha.3 through 0.25.2 have a query amplification vulnerability in the recursive resolver. This flaw arises from improper handling of cyclic sibling name server referrals that lack glue records, allowing attackers controlling two zones with mutually referencing name servers to cause the resolver to loop and generate many upstream queries. The amplification is worsened by zero-TTL NS records.
Hickory DNS versions hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 improperly accept NSEC and NSEC3 DNSSEC nonexistence proofs when other records with the same owner name validate correctly. This allows attackers who can supply DNS responses to mix valid signed records with bogus NSEC or NSEC3 records of different types in the authority section, potentially forging nonexistence proofs.
A vulnerability in Hickory DNS recursive resolver versions 0.25.0 through 0.25.2 and hickory-resolver versions 0.26.0 before 0.26.2 allows crafted negative DNS responses to include out-of-bailiwick records. This can facilitate cache poisoning and exploitation of DNSSEC verification flaws.
Hickory DNS versions hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 have a DNSSEC validation flaw. The flaw causes the software to accept DNS responses as positive answers if any valid RRset is present in the answer section, without verifying that the RRset matches the query. This allows attackers to supply signed but unrelated RRsets, causing responses that lack matching records to be incorrectly validated as positive answers instead of no-data responses.
Hickory DNS versions hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 do not properly verify, according to RFC 6840 §4.4, that an NSEC or NSEC3 record denying a DS RRset also proves the existence of the delegation's NS record. This flaw allows attackers to reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records.
A vulnerability in the DNSSEC validation of the Hickory DNS hickory-net crate versions 0.26.0 up to but not including 0.26.2 allows attackers who can supply DNS responses to forge the nonexistence of any resource record set (RRset). This is achieved by combining a genuine NSEC record and its RRSIG with a crafted SOA record that is accepted even if it fails validation.
Hickory DNS versions from 0.26.0 up to but not including 0.26.2 contain an integer underflow vulnerability in the TSIG RDATA decoding process. This flaw allows remote attackers to send specially crafted TSIG records in DNS wire format that trigger an unchecked subtraction underflow, causing the software to panic and crash when overflow checks are enabled. The resulting denial of service impacts availability but does not affect confidentiality or integrity.
Hickory DNS versions prior to 0.26.2 have a resource exhaustion vulnerability in their DNS-over-HTTPS HTTP/2 server. The server does not enforce sufficient timeouts or limits on incomplete request bodies, allowing remote attackers to open connections with incomplete requests and hold them open. This can exhaust server memory and cause denial of service.
Hickory-dns versions from 0.20.1 up to but not including 0.26.2 contain a denial of service vulnerability in the hickory-proto SVCB and HTTPS record parser. The parser crashes when processing malformed ALPN values such as unbalanced quotes, consecutive commas, or invalid escape sequences. This can be exploited by supplying crafted untrusted zone files to cause a denial of service.
Hickory DNS components hickory-net versions before 0.26.2 and hickory-proto versions 0.25.0 through 0.25.2 have a vulnerability where UDP DNS responses with an empty question section (QDCOUNT=0) bypass validation checks. This allows remote attackers who can inject spoofed UDP responses to circumvent question section matching and case-randomization checks, weakening DNS spoofing defenses.
The devalue package for npm versions before 5.6.3 has a vulnerability that allows excessive CPU and memory consumption when serializing sparse arrays using uneval or stringify. This can lead to a denial of service if an attacker can create and serialize such sparse arrays on the server.
Hickory DNS versions 0.24.0 through 0.26.1 have a memory exhaustion vulnerability. Remote attackers can exploit this by sending incomplete DNS-over-QUIC request bodies with large length prefixes, causing server memory to be exhausted due to persistent pre-allocated buffers. This can lead to denial of service by consuming server resources.