GitHub Advisoryadvisory · crates.io

GHSA-6f2x-v7q7-m7m5 hickory-resolver follows irrelevant CNAME records

MEDIUM Published 2026-10-05 Modified 2026-10-05 Official page ↗
Ecosystem
crates.io
Packages
hickory-resolver
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-400
Reviewed
2026-10-05

Affected packages

• crates.io hickory-resolver: >= 0.25.0, < 0.26.2 → fixed in 0.26.2

Description

When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References