RUSTSEC-2026-0521

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0521

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0521.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0521

Aliases

CVE-2026-123606
GHSA-6h5c-jjg5-wj59
RUSTSEC-2026-0515

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:40:53Z

Summary

Recursor followed every glueless name server in a referral (no fixed hickory-recursor release)

Details

For referrals whose name servers are outside the delegated zone and come without glue, the recursor resolved every listed name server, with no cap on referral width and no per-query work budget. Someone who controls a zone can use this to make each client query send a large number of queries to a victim's servers (the NXNSAttack pattern), or to exhaust the recursor.

The recursor code moved into hickory-resolver (opt-in recursor feature) in 0.26.0-beta.1, and the fix is in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should move to hickory-resolver 0.26.2 or later with the recursor feature.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-recursor

Package

Name: hickory-recursor; View open source insights on deps.dev
Purl: pkg:cargo/hickory-recursor

Affected ranges

Type: SEMVER
Events: Introduced

0.25.0-alpha.3

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}