CVE-2026-123584
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.