CVE-2026-123584 Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123584?
CVE-2026-123584 is a high-severity vulnerability in hickory-dns, published on 8 Nov 2026.
Official description
The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.
Weakness: CWE-696
Which versions are affected by CVE-2026-123584?
1 open source package ship an affected version, including hickory-net.
| Package | Affected | Fixed in |
|---|---|---|
hickory-net crates.io | From 0.26.0 | 0.26.2 |
How do I fix CVE-2026-123584?
Upgrade hickory-net to 0.26.2 or later.
Is CVE-2026-123584 being exploited?
There is no known exploitation of CVE-2026-123584 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-123584, GHSA-v44v-c8m4-gc43, GHSA-v49p-x2x5-v8xm, RUSTSEC-2026-0517, UBUNTU-CVE-2026-123584.