GHSA-6w6g-hm98-mhgm hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)
A malicious DNS server can cause a resource-exhaustion denial of service in the hickory-resolver library by triggering an unbounded retry loop on truncated responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-6w6g-hm98-mhgm?
GHSA-6w6g-hm98-mhgm is a denial of service vulnerability in hickory-resolver, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When the hickory-resolver name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets TC=1 on every available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.
Reporter
Qifan Zhang, Palo Alto Networks
Which versions are affected by GHSA-6w6g-hm98-mhgm?
2 open source packages ship an affected version, including hickory-resolver.
| Package | Affected | Fixed in |
|---|---|---|
hickory-resolver crates.io | From 0.26.0-beta.1 | 0.26.2 |
hickory-resolver crates.io | From 0.26.0-beta.1 | 0.26.2 |
How do I fix GHSA-6w6g-hm98-mhgm?
Upgrade hickory-resolver to 0.26.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-6w6g-hm98-mhgm being exploited?
There is no known exploitation of GHSA-6w6g-hm98-mhgm in the wild and no public exploit code.