hickory-resolver follows irrelevant CNAME records
When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.
GHSA-6f2x-v7q7-m7m5
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-6f2x-v7q7-m7m5
hickory-resolver
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.26.2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0.25.0"
},
{
"fixed": "0.26.2"
}
]
}
],
"package": {
"name": "hickory-resolver",
"purl": "pkg:cargo/hickory-resolver",
"ecosystem": "crates.io"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6f2x-v7q7-m7m5/GHSA-6f2x-v7q7-m7m5.json"
}
}
]Publisher severity
medium
Source reference: /severity/0/score
- Event
- #85909 · Revision 1
- Added to Heist Feed
- Publisher date