DEBIAN-CVE-2026-123585

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-123585

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123585.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-123585

Upstream

CVE-2026-123585

Published

2026-11-08T02:16:52Z

Modified

2026-11-08T16:00:07Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

[none]

Details

The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.

References

https://security-tracker.debian.org/tracker/CVE-2026-123585

Affected packages

Debian:13 / rust-hickory-resolver

Package

Name: rust-hickory-resolver
Purl: pkg:deb/debian/rust-hickory-resolver?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.24.4-1

0.24.4-2

0.24.4-3

0.24.4-4

0.24.4-5

0.25.2-1

0.25.2-2

0.26.1-1

0.26.3-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-123585.json"

Debian:14 / rust-hickory-resolver