Threats tagged 'rustsec-2026-0515'

The Hickory resolver's recursive resolver component (hickory-recursor) prior to version 0.26.2 could be abused via referrals listing many glueless name servers. The resolver would recursively query all listed name servers without per-query limits, potentially causing resource exhaustion. This vulnerability was fixed in version 0.26.2 by limiting recursion to 5 glueless name servers per delegation and 200 upstream queries per client request.