HIGH 8.2 NVD
CVE-2026-123584
The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be p
The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.
References
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-v44v-c8m4-gc43
- https://www.vulncheck.com/advisories/hickory-dns-0.26.0-before-0.26.2-udp-client-denial-of
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.