RUSTSEC-2026-0513

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0513

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0513.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0513

Aliases

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:30:06Z

Summary

Unbounded retries on truncated responses in the name server pool

Details

When an upstream answer had the TC (truncated) bit set, the resolver's name server pool disabled UDP and sent the query again. It did this for every truncated answer, including answers that already came over TCP, and it kept no count of retries.

A name server that sets TC on every answer, which anyone running an authoritative server the resolver queries can do, kept each lookup re-sending queries over the same connection until the request deadline (5 seconds by default) ran out. This uses up resolver resources and sends many queries per lookup.

From 0.26.2 a truncated answer received after UDP has already been disabled ends the lookup with NetError::Truncated instead of retrying again.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-resolver

Package

Name: hickory-resolver; View open source insights on deps.dev
Purl: pkg:cargo/hickory-resolver

Affected ranges

Type: SEMVER
Events: Introduced

0.26.0-beta.1

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}