Hickory DNS CVE-2026-123604

Exploitation requires that the victim's hickory-resolver (version >= 0.26.0-beta.1 and < 0.26.2) send a query whose authoritative answer is controlled by the attacker, and that this malicious authoritative server set the TC (truncated) header bit on responses across every available transport, including over the persistent TCP connection. The flaw is in the NameServerPool::try_send retry arm, which re-queues truncated responses without inspecting the answering transport or counting iterations. Limiting factors: the attacker must control or influence the authoritative response path for a name the target resolves (not arbitrary off-path traffic), the impact is bounded to the 5-second per-request wall-clock deadline per affected request (resource exhaustion rather than permanent lockup), and only the stated version range is affected - upgrading to 0.26.2, which the vendor lists as the fix, removes the condition. There is no confidentiality or integrity impact.

This is a genuine availability risk but a narrow one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with a single high-impact dimension: availability only (VA:H; confidentiality and integrity are N), consistent with CWE-835 (infinite loop) and the advisory's CWE-400/CWE-406 resource-exhaustion classification. There is no confidential or integrity exposure - the sole outcome is a per-request denial of service via an unbounded TC-retry loop. No EPSS score, no CISA KEV listing, and no PoC marked as confirmed working exploit code were provided, so by the precision rules this is 'no public exploit identified at time of analysis'; the only exploitation-adjacent artifacts are the vendor PR and fix commit. Signals are therefore internally consistent rather than conflicting: a high CVSS driven entirely by availability, a vuln.today Decision label of 'this_week' (not act_now/emergency), and no evidence of active exploitation. The practical catch - not captured by PR:N - is that exploitation requires the victim resolver to send a query that an attacker-controlled authoritative server answers, i.e., the attacker must control or influence the authoritative response path for a name the target resolves. Net: a real, patch-worthy DoS for services that resolve attacker-influenced domains using the affected hickory-resolver versions, but not a widespread mass-exploitation emergency.

An attacker operates (or compromises) an authoritative DNS server for a domain that a victim application resolves via hickory-resolver, and configures it to set the TC (truncated) bit on every response across every transport. When the resolver retries over its persistent TCP connection, NameServerPool::try_send re-queues indefinitely without an iteration counter, pinning the worker until the 5-second per-request deadline elapses and exhausting resolver resources. No authentication or user interaction is required (PR:N/UI:N), though the attacker must control the authoritative response for a name the target resolves; no confirmed working public exploit was provided, only the vendor patch.