# cve.now: Hickory-dns

The newest entries naming Hickory-dns as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123608](https://cve.now/CVE-2026-123608.md): Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression (CVSS 8.7)
- [CVE-2026-123607](https://cve.now/CVE-2026-123607.md): Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service (CVSS 8.7)
- [CVE-2026-123606](https://cve.now/CVE-2026-123606.md): Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification (CVSS 8.7)
- [CVE-2026-123605](https://cve.now/CVE-2026-123605.md): Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name (CVSS 8.7)
- [CVE-2026-123604](https://cve.now/CVE-2026-123604.md): Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try\_send TC-Retry Loop (CVSS 8.7)
- [CVE-2026-123603](https://cve.now/CVE-2026-123603.md): Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass (CVSS 6.9)
- [CVE-2026-123602](https://cve.now/CVE-2026-123602.md): Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching (CVSS 8.2)
- [CVE-2026-123601](https://cve.now/CVE-2026-123601.md): Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery (CVSS 8.3)
- [CVE-2026-123600](https://cve.now/CVE-2026-123600.md): Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass (CVSS 6.3)
- [CVE-2026-123599](https://cve.now/CVE-2026-123599.md): Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records (CVSS 6.3)
- [CVE-2026-123598](https://cve.now/CVE-2026-123598.md): Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning (CVSS 6.3)
- [CVE-2026-123597](https://cve.now/CVE-2026-123597.md): Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors (CVSS 6.3)
- [CVE-2026-123596](https://cve.now/CVE-2026-123596.md): Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC (CVSS 8.7)
- [CVE-2026-123595](https://cve.now/CVE-2026-123595.md): Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3 (CVSS 8.7)
- [CVE-2026-123594](https://cve.now/CVE-2026-123594.md): Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals (CVSS 6.3)
- [CVE-2026-123593](https://cve.now/CVE-2026-123593.md): Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via TrustAnchors (CVSS 6.3)
- [CVE-2026-123592](https://cve.now/CVE-2026-123592.md): Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision (CVSS 8.2)
- [CVE-2026-123591](https://cve.now/CVE-2026-123591.md): Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks (CVSS 8.2)
- [CVE-2026-123590](https://cve.now/CVE-2026-123590.md): Hickory DNS 0.26.0-beta.1 before 0.26.2 Improper NSEC/NSEC3 Signature Validation (CVSS 6.3)
- [CVE-2026-123589](https://cve.now/CVE-2026-123589.md): Hickory DNS before 0.26.2 Denial of Service via Missing DNS-over-QUIC Request Read Timeout (CVSS 6.9)
- [CVE-2026-123588](https://cve.now/CVE-2026-123588.md): Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool (CVSS 8.7)
- [CVE-2026-123587](https://cve.now/CVE-2026-123587.md): Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC (CVSS 8.9)
- [CVE-2026-123586](https://cve.now/CVE-2026-123586.md): Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals (CVSS 8.7)
- [CVE-2026-123585](https://cve.now/CVE-2026-123585.md): Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records (CVSS 6.9)
- [CVE-2026-123584](https://cve.now/CVE-2026-123584.md): Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses (CVSS 8.2)
- [CVE-2026-123583](https://cve.now/CVE-2026-123583.md): Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responses (CVSS 6.3)
- [CVE-2026-123582](https://cve.now/CVE-2026-123582.md): Hickory DNS 0.25.0 before 0.26.2 DNSSEC Validation Bypass via SOA Record (CVSS 6.3)
- [CVE-2026-123581](https://cve.now/CVE-2026-123581.md): Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset (CVSS 6.9)
- [CVE-2026-123580](https://cve.now/CVE-2026-123580.md): Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3 (CVSS 8.7)
- [CVE-2026-123579](https://cve.now/CVE-2026-123579.md): Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansion (CVSS 6.3)
- [CVE-2026-123578](https://cve.now/CVE-2026-123578.md): Hickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0 (CVSS 6.3)
- [CVE-2026-123577](https://cve.now/CVE-2026-123577.md): Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service (CVSS 8.7)
- [CVE-2026-123576](https://cve.now/CVE-2026-123576.md): Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests (CVSS 8.7)
- [CVE-2026-123575](https://cve.now/CVE-2026-123575.md): Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies (CVSS 8.7)
- [CVE-2026-123574](https://cve.now/CVE-2026-123574.md): Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser (CVSS 8.7)
- [CVE-2026-123573](https://cve.now/CVE-2026-123573.md): hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser (CVSS 8.7)
- [CVE-2026-123572](https://cve.now/CVE-2026-123572.md): Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser (CVSS 8.7)
- [CVE-2026-123571](https://cve.now/CVE-2026-123571.md): Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding (CVSS 8.7)
- [CVE-2026-123570](https://cve.now/CVE-2026-123570.md): Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts (CVSS 8.7)
- [CVE-2026-93657](https://cve.now/CVE-2026-93657.md): hickory-resolver before 0.26.2 DNSSEC Validation Bypass (CVSS 8.7)
- [CVE-2025-25188](https://cve.now/CVE-2025-25188.md): DNSSEC validation may accept broken authentication chains (CVSS 5.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/hickory-dns
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.