CVE-2026-123607: falha de alta gravidade em hickory-dns
Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXDomain responses with a cross-zone SOA record to panic debug builds or exhaust memory in release builds.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
hickory-dns · hickory-dnsCVEs relacionadas — hickory-dns
No mesmo produto, das mais perigosas para as menos.
CVE-2025-25188MEDIUMDNSSEC validation may accept broken authentication chainsEPSS 0.3%CVE-2026-123608HIGHHickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name CompressionEPSS —CVE-2026-123606HIGHHickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral AmplificationEPSS —CVE-2026-123605HIGHHickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's NameEPSS —CVE-2026-123604HIGHHickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry LoopEPSS —CVE-2026-123603MEDIUMHickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control BypassEPSS —