EUVD-2026-119336
GHSA-7x66-7p9h-vgp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DoH endpoint over HTTP/2 or HTTP/3
-
DeliverySend oversized unbounded request body
-
ExploitServer buffers body in memory without limit
-
ExecutionRepeat to exhaust server memory
-
ImpactDenial of service for DNS clients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target to be running Hickory as a DNS-over-HTTP (DoH) server with HTTP/2 or HTTP/3 enabled; this is the exact configuration GHSA-5r56-v84h-c3w5 names as vulnerable. Affected code is in hickory-server versions >= 0.24.0 and before the 0.26.2 fix. Exploitation needs no authentication, no user interaction, and only network reachability to the DoH endpoint, but it is limited to DoH deployments - servers exposing only classic UDP/TCP DNS (or configurations without the HTTP/2 or HTTP/3 DoH listener) are not affected. The only complete fix stated by the vendor is upgrading to hickory 0.26.2. |
| Impact | This is a remote, unauthenticated availability-only denial of service in the Hickory DNS Rust implementation (formerly Trust-DNS), rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) with impact confined to availability (VA:H; VC:N/VI:N). The provided CVSS 4.0 vector is internally consistent with the description: network-reachable, low complexity, no privileges or user interaction, no attack-requirement condition, and no confidentiality or integrity loss. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no working public exploit is referenced - only vendor/coordinator advisories (GHSA and VulnCheck). The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious but non-actively-exploited availability flaw. The key caveat the raw score obscures: exploitation is not against any default Hickory deployment - it only applies when the server is explicitly configured for DNS over HTTP (DoH) over HTTP/2 or HTTP/3, so the real-world exposure is narrower than AV:N/PR:N alone implies. Treat as a genuine priority for operators running Hickory-based DoH servers; lower concern for those running only classic UDP/TCP DNS. |
| Exploit ScenarioDerived | An attacker who can reach a Hickory-based DNS-over-HTTP endpoint opens an HTTP/2 or HTTP/3 connection and streams an arbitrarily large request body, which the server buffers entirely in memory without any size limit. Repeating this exhausts available memory and renders the DNS service unavailable to legitimate clients. No authentication or user interaction is required, and complexity is low, but no verified public exploit code is referenced at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 08, 2026
Hickory DNS (the Rust DNS library formerly known as Trust-DNS), in hickory-server versions 0.24.0 through 0.26.1, buffers DNS-over-HTTP request bodies in memory without any size limit, so a remote unauthenticated client can stream oversized bodies over HTTP/2 or HTTP/3 and exhaust server memory until the process or host becomes unavailable. Impact is availability-only (CVSS 4.0 8.7, AV:N/AC:L/PR:N/UI:N, VA:H); only deployments actually exposing a DoH listener with HTTP/2 or HTTP/3 are exposed, while classic UDP/TCP DNS servers are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the missing bound makes the attack trivial to attempt against any reachable DoH endpoint.
RemediationAI
Upgrade hickory-server to 0.26.2, which the vendor states as the fix for the unbounded DoH body buffering (GHSA-5r56-v84h-c3w5, https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5r56-v84h-c3w5); the advisory names upgrading as the only complete fix. Where an immediate upgrade is not possible, the exposure is limited to DoH listeners using HTTP/2 or HTTP/3, so removing or disabling those transports and serving DNS only over classic UDP/TCP eliminates the vulnerable code path at the cost of losing DoH support for clients that depend on it; fronting the DoH endpoint with a reverse proxy or load balancer that enforces a small maximum request body size (DNS payloads need only a few kilobytes) reduces but does not remove the risk, and it adds a hop plus configuration that must itself be maintained. Monitoring memory growth per DoH connection and capping concurrent HTTP/2 streams provide only partial protection, since the vendor's position is that updating is the complete remedy.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Hickory DNS is the Rust implementation of DNS (client, server and resolver components), and the vulnerable code path lives in the hickory-server DoH support introduced with 0.24.0. In DNS over HTTP the resolver POSTs DNS wire-format messages to a configured path; the server must read the request body into a buffer before parsing it as a DNS message. Per GHSA-5r56-v84h-c3w5, that buffering is performed without a maximum-size check when the transport is HTTP/2 or HTTP/3, so an attacker controls how much memory the process allocates per request and can multiply that across concurrent streams. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), reported by the advisory as CWE-400/CWE-770: a classic resource-exhaustion DoS where the only barrier to amplification is the server's own memory ceiling. DNS messages themselves are small, so a legitimate DoH body limit would be a few kilobytes; the absence of any cap is what turns a normal parsing step into an availability hazard. Note that the CVSS 4.0 vector's AT:N/E:X and the missing threat metrics mean no exploitation maturity is asserted by the score itself.
Know when Hickory Dns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, low-complexity request to a DoH-enabled server with no user interaction; impact is availability-only memory exhaustion, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. Attackers can send large request bodies over HTTP/2 or HTTP/3 to a DNS over HTTP server, causing memory exhaustion and denial of service.
Technical POC Analysis
CWE-770 (Allocation of Resources Without Limits or Throttling), also classified by the maintainers as CWE-400 (Uncontrolled Resource Consumption).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Hickory DNS server versions 0.24.0 through 0.26.1 contain an unpatched memory exhaustion flaw in their DNS-over-HTTP (DoH) listener. Any organization running a DoH endpoint with HTTP/2 or HTTP/3 on these versions is exposed to a simple remote attack that can take the service and potentially the host offline, affecting availability for all users of that DNS service. Leadership should care because this is an easy-to-trigger denial-of-service against a critical network service, and no vendor patch exists yet.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce HTTP request body size limits at the network edge (reverse proxy/WAF/load balancer) before traffic reaches hickory-server; disable HTTP/3 if not essential; restrict DoH listener exposure to trusted networks; implement memory limits and automatic restart for the DNS service; monitor for abnormally large HTTP request bodies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Hickory DNS Multiple Security Flaws
View all 36More in Hickory Dns
View allMalformed TSIG records can crash Hickory DNS 0.26.0 through 0.26.1 builds compiled with overflow checks enabled, causing
Remote, unauthenticated memory-amplification denial of service affects Hickory DNS (the hickory-proto crate) versions 0.
Exploit-DB