RUSTSEC-2026-0515

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0515

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0515.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0515

Aliases

CVE-2026-123606
GHSA-6h5c-jjg5-wj59
RUSTSEC-2026-0521

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:40:53Z

Summary

Recursor followed every glueless name server in a referral, with no per-query budget

Details

When a referral listed name servers outside the delegated zone and gave no glue addresses, the recursor looked up A and AAAA records for every listed name server, recursing into each one. Only the chain-depth limits applied. There was no cap on how many name servers it chased per referral or on the total upstream work per client query.

Someone who controls a zone can return referrals that list many glueless name servers in a victim's domain, and nest them, so that each client query makes the recursor send a large number of queries to the victim's servers (the NXNSAttack pattern). The same can exhaust the recursor's own resources.

This affects the recursive resolver, which is in hickory-resolver behind the opt-in recursor feature from 0.26.0-beta.1. Earlier releases shipped it as the separate hickory-recursor crate.

From 0.26.2 the recursor follows at most 5 glueless name servers per delegation and sends at most 200 upstream queries per client request.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-resolver

Package

Name: hickory-resolver; View open source insights on deps.dev
Purl: pkg:cargo/hickory-resolver

Affected ranges

Type: SEMVER
Events: Introduced

0.26.0-beta.1

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}