CVE-2026-123576
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 08, 2026
Vendor
unknown
Description
Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.