RUSTSEC-2026-0522

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0522

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0522.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0522

Aliases

CVE-2026-123586
GHSA-cx5j-p54p-q756
RUSTSEC-2026-0516

Published

2026-09-03T12:00:00Z

Modified

2026-11-12T14:40:46Z

Summary

Recursor kept querying cyclic glueless sibling delegations (no fixed hickory-recursor release)

Details

Two zones can each delegate to name servers named only inside the other zone, with no glue records (RFC 9471 section 2.3). The recursor did not stop when it came back to a zone it was already resolving, so someone who controls two such zones can make it send many upstream queries for each client query.

The recursor code moved into hickory-resolver (opt-in recursor feature) in 0.26.0-beta.1, and the fix is in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should move to hickory-resolver 0.26.2 or later with the recursor feature.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / hickory-recursor

Package

Name: hickory-recursor; View open source insights on deps.dev
Purl: pkg:cargo/hickory-recursor

Affected ranges

Type: SEMVER
Events: Introduced

0.25.0-alpha.3

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}