CVE-2026-123586 affects the Hickory resolver's recursive resolver component, where cyclic glueless sibling delegations cause the resolver to repeatedly query the same zones without stopping. This leads to excessive upstream queries per client request. The issue is fixed in version 0.26.2 by tracking zones on the resolution stack and preventing re-entry into already visited zones.