Vulnerability RUSTSEC-2026-0522
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 months ago
September 03, 2026 at 12:00 PM UTC
Recursor kept querying cyclic glueless sibling delegations (no fixed hickory-recursor release)
>=0.25.0-alpha.3
>=0.25.0-alpha.3
Summary
Recursor kept querying cyclic glueless sibling delegations (no fixed hickory-recursor release)
Details
Two zones can each delegate to name servers named only inside the other zone, with no glue records (RFC 9471 section 2.3). The recursor did not stop when it came back to a zone it was already resolving, so someone who controls two such zones can make it send many upstream queries for each client query.
The recursor code moved into hickory-resolver (opt-in recursor feature) in 0.26.0-beta.1, and the fix is in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should move to hickory-resolver 0.26.2 or later with the recursor feature.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 months ago
Recursor followed every glueless name server in a referral (no fixed hickory-recursor release)
>=0.25.0-alpha.3 RUSTSEC-2026-0521
>=0.25.0-alpha.3 RUSTSEC-2026-0521
High Risk
6 months ago
Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation
>=0.24.0 <0.26.0, ==0.1 GHSA-83hf-93m4-rgwq
>=0.24.0 <0.26.0, ==0.1 GHSA-83hf-93m4-rgwq
Unknown
6 months ago
Record cache accepts AUTHORITY section NS from sibling zone via parent-pool zone-context elevation
>=0.0.0-0 RUSTSEC-2026-0106
>=0.0.0-0 RUSTSEC-2026-0106
Impacted packages
Timeline
Published
2 months ago
September 03, 2026 at 12:00 PM UTC
Last Modified
1 day ago
November 12, 2026 at 02:40 PM UTC