Summary
hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)
Advisory details
When the hickory-resolver name server pool implementation receives an upstream response with the TC (truncated) header bit set, it re-queues the request to the same nameserver to retry with UDP transport disabled. However, the retry arm never inspects the transport that just answered and carries no iteration counter. An authoritative server that sets TC=1 on every available transport keeps the resolver spinning on one persistent TCP connection until the 5s per-request wall-clock deadline expires.
Reporter
Qifan Zhang, Palo Alto Networks
References
- https://github.com/advisories/GHSA-6w6g-hm98-mhgm
- https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm
- https://github.com/hickory-dns/hickory-dns/pull/3871
- https://github.com/hickory-dns/hickory-dns/commit/0848d2e9e4183499343318a690d6dd5e48bc21c1
- https://github.com/hickory-dns/hickory-dns/commit/5d37e2e04a36a87013a213b58b820345ef76a263
- https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-107391
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
- HIGHCVE-2026-101895
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
- HIGHCVE-2026-81876
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
- HIGHCVE-2026-68523
Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service
- MEDIUMCVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts
- MEDIUMCVE-2026-100350
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression