CVE-2026-123575

EUVD-2026-119334
Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.48%
Debian logo
Debian Releases
Debian Product
Codename
rust-hickory-dns
forky
0.26.3-1
fixed
sid
0.26.3-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-g5xf-qv55-wv37
https://www.vulncheck.com/advisories/hickory-dns-before-0.26.2-doh-memory-exhaustion-via-incomplete-request-bodies