CVE-2026-123575: falha de alta gravidade em hickory-dns
Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.4%
Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
hickory-dns · hickory-dnsCVEs relacionadas — hickory-dns
No mesmo produto, das mais perigosas para as menos.
CVE-2026-123608HIGHHickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name CompressionEPSS 0.4%CVE-2026-123606HIGHHickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral AmplificationEPSS 0.4%CVE-2026-123577HIGHHickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of ServiceEPSS 0.4%CVE-2026-123576HIGHHickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC RequestsEPSS 0.4%CVE-2026-123571HIGHHickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA DecodingEPSS 0.4%CVE-2026-123570HIGHHickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR CountsEPSS 0.4%