Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. hickory-resolver
  4. ›
  5. GHSA-6w6g-hm98-mhgm

GHSA-6w6g-hm98-mhgm: hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

October 5, 2026

When the hickory-resolver name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets TC=1 on every available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.

References

  • github.com/advisories/GHSA-6w6g-hm98-mhgm
  • github.com/hickory-dns/hickory-dns/commit/0848d2e9e4183499343318a690d6dd5e48bc21c1
  • github.com/hickory-dns/hickory-dns/commit/5d37e2e04a36a87013a213b58b820345ef76a263
  • github.com/hickory-dns/hickory-dns/pull/3871
  • github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
  • github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm

Code Behaviors & Features

Detect and mitigate GHSA-6w6g-hm98-mhgm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions starting from 0.26.0-beta.1 before 0.26.2

Fixed versions

  • 0.26.2

Solution

Upgrade to version 0.26.2 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption
  • CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

Source file

cargo/hickory-resolver/GHSA-6w6g-hm98-mhgm.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:29 +0000.