CVE-2026-123575
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 08, 2026
Vendor
unknown
Description
Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.