hickory-resolver
crates.io3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting hickory-resolverpage 1 of 1
- CVE-2026-123585MEDIUMCVSS 5.3EG 5.3fixed in 0.26.22026-11-08
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses …
- CVE-2026-123604HIGHCVSS 7.5EG 7.5fixed in 0.26.22026-11-08
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious au…
- CVE-2026-93657HIGHCVSS 7.5EG 7.5fixed in 0.26.22026-09-18
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the ans…
Check whether hickory-resolver is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for hickory-resolver CVEs against the assets you own.
Book a Demo →