GHSA-6f2x-v7q7-m7m5
hickory-resolver follows irrelevant CNAME records
- Risk score
- 41/100
- CVSS
- 6.9 v4.0
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a…
- Affected
- hickory-resolver (rust) >= 0.25.0, < 0.26.2
- Fix
- Upgrade hickory-resolver to 0.26.2 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.9 medium
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| hickory-resolver | rust | >= 0.25.0, < 0.26.2 | 0.26.2 |
References
- https://github.com/advisories/GHSA-6f2x-v7q7-m7m5
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
- https://github.com/hickory-dns/hickory-dns/pull/3871
- https://github.com/hickory-dns/hickory-dns/commit/4689fc8d3ddd3e3f99ec1b7be4e2e9e78afd2e6b
- https://github.com/hickory-dns/hickory-dns/commit/ccd6952378f250c714fc2af0cb1053e1c179f832
- https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
- https://github.com/advisories/GHSA-6f2x-v7q7-m7m5
Original description
When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.
Last activity 5 Oct 2026. Patch Forecast updates every hour.