CVE-2026-123576: fallo de gravedad alta en hickory-dns
Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.4%
Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
hickory-dns · hickory-dnsCVEs relacionadas — hickory-dns
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-123608HIGHHickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name CompressionEPSS 0.4%CVE-2026-123606HIGHHickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral AmplificationEPSS 0.4%CVE-2026-123577HIGHHickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of ServiceEPSS 0.4%CVE-2026-123575HIGHHickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request BodiesEPSS 0.4%CVE-2026-123571HIGHHickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA DecodingEPSS 0.4%CVE-2026-123570HIGHHickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR CountsEPSS 0.4%