CVE-2026-123576
Received Received - Intake

Memory Exhaustion in Hickory DNS via Incomplete QUIC Requests

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123576
EUVD
EUVD-2026-119335

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hickory-dns hickory-dns From 0.24.0 (inc) to 0.26.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Hickory DNS versions 0.24.0 to 0.26.1 have a memory exhaustion flaw. Attackers can send incomplete DNS-over-QUIC requests with large length prefixes but no data, causing the server to reserve memory buffers indefinitely. This leads to resource exhaustion and potential denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal memory usage or incomplete DNS-over-QUIC requests. Check for processes consuming excessive memory, especially hickory-dns. Use network monitoring tools like tcpdump or Wireshark to inspect DNS-over-QUIC traffic for incomplete request bodies with large length prefixes.

Impact Analysis

If you run a vulnerable Hickory DNS server, attackers could crash it by consuming all available memory. This disrupts DNS services, causing downtime and potential loss of connectivity for users relying on your server.

Mitigation Strategies

Immediately update hickory-dns to a version beyond 0.26.1. Implement rate limiting on DNS-over-QUIC connections. Configure timeouts for incomplete requests to prevent memory exhaustion. Monitor server memory usage closely for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...