Vulnerability RUSTSEC-2026-0521

For referrals whose name servers are outside the delegated zone and come without glue, the recursor resolved every listed name server, with no cap on referral width and no per-query work budget. Someone who controls a zone can use this to make each client query send a large number of queries to a victim's servers (the NXNSAttack pattern), or to exhaust the recursor.

The recursor code moved into hickory-resolver (opt-in recursor feature) in 0.26.0-beta.1, and the fix is in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should move to hickory-resolver 0.26.2 or later with the recursor feature.