RUSTSEC-2026-0516

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0516

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0516.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0516

Aliases

CVE-2026-123586
GHSA-cx5j-p54p-q756
RUSTSEC-2026-0522

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:40:46Z

Summary

Recursor kept querying cyclic glueless sibling delegations

Details

Two zones can each delegate to name servers named only inside the other zone, with no glue records (the cyclic sibling case in RFC 9471 section 2.3). Such delegations can never be resolved, but the recursor did not stop when it came back to a zone it was already resolving. It kept sending queries until the per-request limits ran out, and zero TTLs on the referral NS records made this worse.

Someone who controls two such zones can make a recursor send many upstream queries for each client query.

This affects the recursive resolver, which is in hickory-resolver behind the opt-in recursor feature from 0.26.0-beta.1. Earlier releases shipped it as the separate hickory-recursor crate.

From 0.26.2 each client request tracks the zones on its resolution stack and refuses to enter a zone that is already on it.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-resolver

Package

Name: hickory-resolver; View open source insights on deps.dev
Purl: pkg:cargo/hickory-resolver

Affected ranges

Type: SEMVER
Events: Introduced

0.26.0-beta.1

Fixed

0.26.2

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}