{"id":"RUSTSEC-2026-0513","summary":"Unbounded retries on truncated responses in the name server pool","details":"When an upstream answer had the TC (truncated) bit set, the resolver's name server pool disabled UDP and sent the query again. It did this for every truncated answer, including answers that already came over TCP, and it kept no count of retries.\n\nA name server that sets TC on every answer, which anyone running an authoritative server the resolver queries can do, kept each lookup re-sending queries over the same connection until the request deadline (5 seconds by default) ran out. This uses up resolver resources and sends many queries per lookup.\n\nFrom 0.26.2 a truncated answer received after UDP has already been disabled ends the lookup with `NetError::Truncated` instead of retrying again.","aliases":["CVE-2026-123604","GHSA-6w6g-hm98-mhgm"],"modified":"2026-11-12T14:30:06.796669440Z","published":"2026-09-03T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-resolver"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0513.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/f9a7bc5d188e5b680b09aea91009d2fbf3fec58a"}],"affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affects":{"arch":[],"os":[],"functions":[]},"affected_functions":null},"database_specific":{"categories":["denial-of-service"],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0513.json","cvss":null,"informational":null}}],"schema_version":"1.9.2"}