Vulnerability RUSTSEC-2026-0515
Summary
Recursor followed every glueless name server in a referral, with no per-query budget
Details
When a referral listed name servers outside the delegated zone and gave no glue addresses, the recursor looked up A and AAAA records for every listed name server, recursing into each one. Only the chain-depth limits applied. There was no cap on how many name servers it chased per referral or on the total upstream work per client query.
Someone who controls a zone can return referrals that list many glueless name servers in a victim's domain, and nest them, so that each client query makes the recursor send a large number of queries to the victim's servers (the NXNSAttack pattern). The same can exhaust the recursor's own resources.
This affects the recursive resolver, which is in hickory-resolver behind the opt-in recursor feature from 0.26.0-beta.1. Earlier releases shipped it as the separate hickory-recursor crate.
From 0.26.2 the recursor follows at most 5 glueless name servers per delegation and sends at most 200 upstream queries per client request.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
