Hickory DNS CVE-2026-123585

The attacker must be able to control the content of DNS responses that the Hickory resolver processes during recursive resolution - i.e. operate (or spoof) the authoritative server for a name the resolver queries, or be positioned on-path to inject responses. The specific trigger is including CNAME records in the authority or additional sections, or CNAME records outside the CNAME chain that begins at the original query name; the resolver then follows them. Limiting factors: exploitation only produces excess queries/amplification (VA:L, availability-only, no confidentiality or integrity impact), it requires the victim resolver to actually resolve an attacker-influenced name, and it affects only Hickory DNS (hickory-resolver) versions 0.25.0 up to but not including 0.26.2 - updating to 0.26.2 is the fix.

This is a moderate-severity denial-of-service / resource-exhaustion issue (CWE-400), not a code-execution or data-exposure flaw. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, but every impact metric except availability is N, and availability is only VA:L (low) with no subsequent-system impact (SC:N/SI:N/SA:N) - consistent with the 6.9 score reflecting nuisance-level amplification rather than resolver crash. No EPSS score was provided in the input, and the CVE is NOT in CISA KEV, so there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a real-but-non-urgent priority. The references include a VulnCheck advisory and the GHSA advisory plus patch PR/commit, but the input does NOT mark any item as confirmed working exploit code, so this should be treated as a patch-in-normal-cycle issue rather than a drop-everything emergency. Net: genuine but low-to-moderate real-world risk, bounded by the attacker's need to control DNS responses the resolver follows.

An attacker who controls DNS responses - e.g. operating an authoritative server for a domain the Hickory resolver recursively queries, or acting as an on-path responder - returns a response that places CNAME records in the authority or additional sections, or CNAMEs that are not part of the legitimate chain starting from the queried name. The Hickory resolver follows these irrelevant CNAMEs and issues extra, unnecessary queries, amplifying outbound query volume and consuming resolver resources. No public exploit is identified in the provided data; the attack is network-based and, per CVSS PR:N, requires no authentication.