EUVD-2026-119348
GHSA-hpqr-cvqv-p4qm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DoQ listener over network
-
ExploitOpen QUIC connection and request stream
-
ExecutionWithhold request message indefinitely
-
ImpactExhaust/hold server resources (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target to be running hickory-server's DNS-over-QUIC (DoQ) listener - an opt-in protocol mode, not DNS over UDP/TCP, so servers without DoQ enabled are unaffected. When DoQ is enabled, exploitation is remote and unauthenticated (PR:N/UI:N) against affected versions <= 0.26.1 with no special configuration needed beyond network reachability to the QUIC port. The principal limiting factor is exposure of the DoQ endpoint to untrusted clients; impact is bounded to resource consumption/availability degradation rather than compromise, and the only complete fix is upgrading to 0.26.2. |
| Impact | This is a medium-severity, resource-exhaustion denial-of-service issue, not a code-execution or data-exposure flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated trigger with no user interaction, but impact is confined to availability at low magnitude (VA:L; VC:N/VI:N) - consistent with a single stuck stream slowly consuming resources rather than an instant crash. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no signal of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' No SSVC/automatable signal was supplied; the only priority signal is the vuln.today 'this_month' decision label (reported by VulnCheck), which is a routine-remediation tier below act_now/emergency. The practical risk is bounded by exposure: it only affects deployments that actually run hickory-server's DNS-over-QUIC listener, which is an opt-in protocol mode. Net: a legitimate but non-urgent availability bug - patch within a normal maintenance window (aligning with the 'this_month' label), prioritized higher only if you expose DoQ to untrusted networks. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker opens a QUIC connection to a hickory-server instance with the DNS-over-QUIC listener enabled, opens a request stream, and then simply never finishes sending the request message. Because no read timeout is applied, the server holds the stream and its associated resources open indefinitely; repeating this across many connections ties up server resources and degrades or denies DNS service. No public exploit code or PoC reference was supplied, and the low attack complexity (AC:L) means no special timing or preconditions are needed beyond reaching the DoQ port. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 08, 2026
Missing request-read timeout in the DNS-over-QUIC (DoQ) listener of hickory-server (hickory-dns) 0.26.1 and earlier allows a remote unauthenticated client to open a QUIC connection and request stream and hold it open indefinitely, bypassing every configured timeout and steadily consuming server resources. Impact is bounded to availability degradation on servers that have the opt-in DoQ listener enabled and reachable from untrusted networks; DNS over UDP/TCP deployments that do not run DoQ are unaffected. There is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is fixed in 0.26.2; vuln.today prioritizes it for remediation this month.
RemediationAI
Vendor-released patch: upgrade hickory-server to 0.26.2, which adds the missing timeout when reading a DoQ request message; the independent assessment notes that upgrading is the only complete fix, and the advisory is at https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-g8wg-4mwh-fjfv. If the upgrade cannot be applied immediately, exposure can be reduced by disabling the DNS-over-QUIC listener entirely and serving clients over DNS over TLS or DNS over HTTPS instead - the trade-off is loss of the DoQ transport and possible client fallback behavior - or, when DoQ must stay enabled, by restricting network reachability to the DoQ port so only trusted resolvers can connect, which limits but does not eliminate the resource-consumption risk from permitted clients. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, so remediation can follow a normal monthly patch cadence rather than an emergency one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
hickory-dns is a Rust DNS implementation whose hickory-server component can expose a DNS-over-QUIC (DoQ) listener, an opt-in transport that carries DNS messages inside QUIC streams (RFC 9250) rather than over UDP or TCP. Because QUIC streams are cheap to open and multiplex, each incoming request stream needs its own read deadline; in affected versions the DoQ server applies no timeout when reading the request message from the stream, so the server's configured timeout settings are effectively bypassed for this code path. A single client can therefore establish a connection, open a request stream, and simply never finish sending, leaving the server holding per-connection and per-stream state indefinitely. The vulnerability class is an uncontrolled resource consumption / missing timeout problem (no CWE was supplied in the source data), and the assessed impact is availability-only (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - no confidentiality or integrity effect is described. The exact triggering conditions beyond holding a request stream open are not elaborated further in the available sources.
Know when Hickory Dns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Remote unauthenticated DoQ client with no interaction (AV:N/AC:L/PR:N/UI:N); impact limited to partial availability loss via resource holding (A:L), no confidentiality/integrity effect and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely, consuming server resources and causing a denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Hickory DNS Multiple Security Flaws
View all 36More in Hickory Dns
View allMalformed TSIG records can crash Hickory DNS 0.26.0 through 0.26.1 builds compiled with overflow checks enabled, causing
Remote, unauthenticated memory-amplification denial of service affects Hickory DNS (the hickory-proto crate) versions 0.
Exploit-DB