# CVE-2026-123604: Hickory DNS hickory-resolver unbounded retry loop resource exhaustion

Source: https://junglewise.ai/threats/cve-2026-123604-hickory-dns-hickory-resolver-0-26-0-beta-1-before-0-26-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123604 · Severity: high · CVSS 7.5 · Published 2026-11-08

Hickory DNS is a DNS resolver library used by applications to perform domain name lookups. A vulnerability in its name server pool implementation allows a malicious DNS server to cause the resolver to enter an infinite retry loop, consuming CPU and memory resources until requests time out. This denial-of-service attack requires no authentication and can exhaust resolver capacity, disrupting DNS resolution for applications relying on affected versions.

Technologies: [Hickory-Dns Hickory-Resolver](https://junglewise.ai/threats/technologies/hickory-resolver). Vendors: [Hickory-Dns](https://junglewise.ai/threats/vendors/hickory-dns).

## Quick answers

**Is CVE-2026-123604 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123604 being exploited in the wild.

**How severe is CVE-2026-123604?** High severity, with a CVSS score of 7.5, published 8 November 2026.

**Which products and versions are affected?** Hickory-Dns Hickory-Resolver 0.26.0-beta.1 through 0.26.1.

**Is there a fix for CVE-2026-123604?** Yes: fixed in 0.26.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123604 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123604?** Check whether you run Hickory-Dns Hickory-Resolver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.26.2

## Technical details

The NameServerPool::try_send function re-queues DNS requests with the TC (truncated) bit set to retry over TCP without checking which transport answered or implementing an iteration counter. A malicious authoritative nameserver can set TC=1 on every transport to trigger an unbounded loop that persists until the 5-second per-request deadline expires, exhausting resolver resources. The vulnerability affects hickory-resolver versions 0.26.0-beta.1 through 0.26.1 and is fixed in 0.26.2.

## Affected products

- Hickory DNS hickory-resolver 0.26.0-beta.1 through 0.26.1

## Timeline

- 2026-09-03: disclosed
- 2026-09-03: patched
- 2026-11-08: advisory

## References

- [https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm)
- [https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-resource-exhaustion-dos-via-nameserverpool-try-send-tc-retry-loop](https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-resource-exhaustion-dos-via-nameserverpool-try-send-tc-retry-loop)

## Related threats

- [hickory-dns recursor glueless-NS referral amplification](https://junglewise.ai/threats/cve-2026-123606-the-hickory-dns-recursor-in-hickory-recursor-0-25-0-alpha-3)
- [Hickory DNS IPv4-mapped IPv6 canonicalization bypass](https://junglewise.ai/threats/cve-2026-123603-hickory-proto-and-hickory-resolver-0-26-0-before-0-26-2-hickory)
- [Hickory DNS recursor cache poisoning via ghost domain attack](https://junglewise.ai/threats/cve-2026-123602-the-hickory-dns-recursor-in-all-versions-of-hickory-recursor-and)
- [Hickory DNS recursive resolver denial of service via cached empty connection pool](https://junglewise.ai/threats/cve-2026-123588-the-recursive-resolver-in-hickory-dns-all-versions-of-the)
- [Hickory DNS query amplification in recursive resolver](https://junglewise.ai/threats/cve-2026-123586-hickory-dns-0-25-0-alpha-3-through-0-25-2-contains-a-query)