Hickory DNS CVE-2026-123584

Exploitation requires an active, in-flight UDP client query: the victim hickory-net client must be listening for a response from a name server when the spoofed malformed datagram arrives, and the attacker must guess the ephemeral UDP source port of that connection. The limiting factors are (1) the timing window - the malformed datagram must land while the socket is listening; (2) source-port guessing, whose difficulty scales with the client's port-randomization entropy; and (3) version - only 0.26.0 and 0.26.1 are affected (fixed in 0.26.2). Notably the attacker does NOT need the DNS transaction ID, which removes the usual entropy barrier and makes the port the sole secret to guess. No authentication or user interaction is required (PR:N/UI:N).

This is a genuine availability-only risk whose real-world priority is moderate, not critical, despite the 8.2 score. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) confirms a remote, unauthenticated attack but with elevated attack complexity (AC:H) and a specific attack requirement (AT:P), reflecting that the attacker must win a timing race by spoofing a malformed datagram while the client is actively listening for a response, and must correctly guess the ephemeral UDP source port (though not the transaction ID - which is what lowers the bar relative to cache-poisoning variants of TuDoor). Impact is confined to availability (VC:N/VI:N/VA:H): a successful spoof aborts the in-flight client query, causing denial of service, with no confidentiality or integrity effect. EPSS is not provided in the input, and KEV status is absent, so there is no evidence of active exploitation; the vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a patch-this-cycle rather than drop-everything posture. No PoC or exploit reference is supplied in the input - the TuDoor academic paper describes the attack class but is not itself a working exploit for this crate - so this remains theoretical-but-credible. The main caveat: exploitation depends on the attacker guessing the source port within the query's open listening window, which the vendor describes as feasible but which real-world success rates will depend on port-randomization entropy and query timing.

While a hickory-net UDP client is awaiting a DNS response, a remote attacker floods spoofed UDP datagrams at the client's resolver, guessing the ephemeral source port and sending payloads that fail DNS message parsing. Because only the port (not the transaction ID) must be guessed, a malformed datagram that lands on the right port causes the client to stop listening and return an error, aborting the legitimate query and denying resolution. No public working exploit is identified in the input, though this is the DoS variant of the documented TuDoor attack.