CVE-2026-123588 is a high-severity vulnerability in Hickory DNS's recursive resolver affecting all versions of the hickory-recursor crate and hickory-resolver versions before 0.26.2. The resolver caches an empty connection pool when it encounters a referral with no glue records and all IP address queries for the name servers fail. An attacker capable of spoofing DNS responses can exploit this to cause all subsequent queries for the affected zone to fail until the cache entry expires or is evicted.
CVE-2026-123587 is a high-severity vulnerability in the Hickory DNS hickory-net crate versions 0.26.0 up to but not including 0.26.2. It involves an authentication bypass via spoofing in DNSSEC validation, where crafted responses can cause the software to incorrectly accept invalid SOA records. This allows attackers who can supply DNS responses to forge the nonexistence of any resource record set (RRset).
CVE-2026-123586 is a high-severity vulnerability in hickory-dns versions 0.25.0-alpha.3 through 0.25.2. It involves a query amplification flaw in the recursive resolver caused by mishandling cyclic sibling name server referrals without glue records. This can cause the resolver to loop, generating many upstream queries amplified by zero-TTL NS records. The issue is fixed in version 0.26.2.
CVE-2026-123585 is a vulnerability in the hickory-resolver component of Hickory DNS versions 0.25.0 up to but not including 0.26.2. The resolver follows irrelevant CNAME records when resolving recursive queries, leading to unnecessary DNS queries. This behavior can be exploited by attackers controlling DNS responses to cause excessive resolver queries and increased query amplification.
CVE-2026-123584 is a vulnerability in the hickory-net crate of Hickory DNS versions 0.26.0 through before 0.26.2. It causes the DNS client to stop listening and return an error when receiving a malformed UDP datagram that cannot be parsed as a DNS message. This allows remote attackers who can guess the source port but not the transaction ID to send spoofed malformed responses that abort client queries, resulting in denial of service.
CVE-2026-123583 is a vulnerability in Hickory DNS recursive resolver versions 0.25.0 through 0.25.2 and hickory-resolver versions 0.26.0 before 0.26.2. The flaw involves the failure to apply out-of-bailiwick filtering to negative DNS responses, allowing attackers to inject crafted out-of-bailiwick records. This can facilitate cache poisoning and make exploitation of other DNSSEC verification flaws easier. The issue is fixed in version 0.26.2.
CVE-2026-123582 is a vulnerability in Hickory DNS versions 0.25.0 up to but not including 0.26.2. The validating recursive resolver and forwarder do not verify that the SOA record has passed DNSSEC validation when creating NXDOMAIN or NODATA responses. This flaw allows an attacker who can forge DNS responses to supply a forged SOA record with the AD bit set, potentially misleading clients that trust the server's DNSSEC validation.
CVE-2026-123581 is a vulnerability in Hickory DNS affecting versions up to 0.26.0-alpha.1 and 0.26.0-beta.1 before 0.26.2. It involves a DNSSEC validation flaw where the software incorrectly accepts DNS responses as valid if any signed RRset is present, without verifying that the RRset matches the query. This can allow attackers to supply signed but unrelated RRsets, causing responses that lack matching records to be validated as positive answers instead of no-data responses.
CVE-2026-123580 is an authentication bypass vulnerability in Hickory DNS affecting versions 0.26.0-beta.1 through before 0.26.2 and hickory-proto through 0.26.0-alpha.1. The flaw arises from insufficient validation of NSEC3 record names during DNSSEC verification, where only the hashed label is checked without confirming the record's zone membership. This allows attackers to forge DNSSEC nonexistence proofs by supplying NSEC3 records from other zones with matching hash labels.
CVE-2026-123579 is a vulnerability in Hickory DNS affecting versions 0.26.0-beta.1 through before 0.26.2 and hickory-proto through 0.26.0-alpha.1. The DNSSEC validation does not properly distinguish between NODATA responses and wildcard-expanded positive responses. This flaw allows an attacker to craft a bogus positive DNS response by combining an NSEC3 record with a signed wildcard record, which the validation process incorrectly accepts.
CVE-2026-123578 is an authentication bypass vulnerability in hickory-dns affecting versions 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2. The flaw allows remote attackers to bypass DNS spoofing defenses by sending UDP responses with an empty question section (QDCOUNT=0), which causes the software to skip critical validation checks.
CVE-2026-123577 is a resource exhaustion vulnerability in hickory-dns versions 0.24.0 up to but not including 0.26.2. It allows remote attackers to cause denial of service by sending large DNS over HTTP (DoH) request bodies over HTTP/2 or HTTP/3, leading to server memory exhaustion.
Hickory DNS versions 0.24.0 through 0.26.1 have a memory exhaustion vulnerability due to lack of limits on resource allocation when processing incomplete DNS-over-QUIC requests. Remote attackers can exploit this by opening many connections and sending large length prefixes without completing requests, causing server memory to be exhausted.
CVE-2026-123575 is a resource exhaustion vulnerability in hickory-dns versions before 0.26.2. The DNS-over-HTTPS HTTP/2 server in affected versions lacks sufficient timeouts or limits on incomplete request bodies, allowing remote attackers to hold connections open and exhaust server memory.
CVE-2026-123574 is a high-severity vulnerability in the hickory-proto crate of Hickory DNS versions 0.24.0 up to but not including 0.26.2. The zone file parser improperly handles tokens of 4096 bytes or longer, causing the parser to panic. This can be exploited by attackers who supply maliciously crafted zone files to trigger a denial of service condition.
CVE-2026-123573 is a denial of service vulnerability in hickory-dns versions from 0.20.1 up to but not including 0.26.2. The flaw exists in the hickory-proto SVCB and HTTPS record presentation format parser, where specially crafted zone files containing a single or double quote replacing a service parameter value cause a panic that crashes the parser. This vulnerability has a high severity rating with a CVSS score of 8.7. It is fixed in version 0.26.2.
CVE-2026-123572 is a denial of service vulnerability in hickory-dns versions 0.20.1 up to but not including 0.26.2. The flaw exists in the hickory-proto SVCB and HTTPS record presentation format parser, which panics when processing malformed ALPN values such as unbalanced quotes, consecutive commas, or invalid escape sequences. This can cause the parsing process to crash when attackers supply crafted untrusted zone files.
An integer underflow vulnerability exists in Hickory DNS versions 0.26.0 up to but not including 0.26.2. The flaw occurs in the TSIG RDATA decoding process, where a crafted TSIG record can cause unchecked subtraction underflow, leading to a panic and denial of service by crashing the application. This vulnerability has a high severity score of 8.7 and is fixed in version 0.26.2.
CVE-2026-123570 is a high-severity vulnerability in hickory-dns versions 0.18 up to but not including 0.26.2. The DNS wire-format message parser preallocates memory based on untrusted header fields (ANCOUNT, NSCOUNT, ARCOUNT), which can be manipulated by remote attackers to cause excessive memory allocation of about 18MB per message. This can lead to uncontrolled resource consumption and potential denial of service.