{"id":"RUSTSEC-2026-0515","summary":"Recursor followed every glueless name server in a referral, with no per-query budget","details":"When a referral listed name servers outside the delegated zone and gave no glue addresses, the recursor looked up A and AAAA records for every listed name server, recursing into each one. Only the chain-depth limits applied. There was no cap on how many name servers it chased per referral or on the total upstream work per client query.\n\nSomeone who controls a zone can return referrals that list many glueless name servers in a victim's domain, and nest them, so that each client query makes the recursor send a large number of queries to the victim's servers (the NXNSAttack pattern). The same can exhaust the recursor's own resources.\n\nThis affects the recursive resolver, which is in hickory-resolver behind the opt-in `recursor` feature from 0.26.0-beta.1. Earlier releases shipped it as the separate hickory-recursor crate.\n\nFrom 0.26.2 the recursor follows at most 5 glueless name servers per delegation and sends at most 200 upstream queries per client request.","aliases":["CVE-2026-123606","GHSA-6h5c-jjg5-wj59","RUSTSEC-2026-0521"],"modified":"2026-11-12T14:40:53.913632545Z","published":"2026-09-03T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-resolver"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0515.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/74062f3a3ef6904b64717dd025945702b2cf4133"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/47cd005b8f3d190134bbb943d2328ef8a83ade8c"}],"affected":[{"package":{"name":"hickory-resolver","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.26.0-beta.1"},{"fixed":"0.26.2"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"functions":[],"arch":[],"os":[]}},"database_specific":{"informational":null,"categories":["denial-of-service"],"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0515.json","cvss":null}}],"schema_version":"1.9.2"}