{"id":"RUSTSEC-2026-0521","summary":"Recursor followed every glueless name server in a referral (no fixed hickory-recursor release)","details":"For referrals whose name servers are outside the delegated zone and come without glue, the recursor resolved every listed name server, with no cap on referral width and no per-query work budget. Someone who controls a zone can use this to make each client query send a large number of queries to a victim's servers (the NXNSAttack pattern), or to exhaust the recursor.\n\nThe recursor code moved into hickory-resolver (opt-in `recursor` feature) in 0.26.0-beta.1, and the fix is in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should move to hickory-resolver 0.26.2 or later with the `recursor` feature.","aliases":["CVE-2026-123606","GHSA-6h5c-jjg5-wj59","RUSTSEC-2026-0515"],"modified":"2026-11-12T14:40:53.913632545Z","published":"2026-09-03T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hickory-recursor"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0521.html"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/74062f3a3ef6904b64717dd025945702b2cf4133"},{"type":"WEB","url":"https://github.com/hickory-dns/hickory-dns/commit/47cd005b8f3d190134bbb943d2328ef8a83ade8c"}],"affected":[{"package":{"name":"hickory-recursor","ecosystem":"crates.io","purl":"pkg:cargo/hickory-recursor"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.25.0-alpha.3"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"os":[],"functions":[]}},"database_specific":{"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0521.json","categories":["denial-of-service"]}}],"schema_version":"1.9.2"}