CVE-2026-123575: high-severity vulnerability in hickory-dns
Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.4%
Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
hickory-dns · hickory-dnsRelated CVEs — hickory-dns
In the same product, most dangerous first.
CVE-2026-123608HIGHHickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name CompressionEPSS 0.4%CVE-2026-123606HIGHHickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral AmplificationEPSS 0.4%CVE-2026-123577HIGHHickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of ServiceEPSS 0.4%CVE-2026-123576HIGHHickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC RequestsEPSS 0.4%CVE-2026-123571HIGHHickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA DecodingEPSS 0.4%CVE-2026-123570HIGHHickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR CountsEPSS 0.4%