High severity7.5NVD Advisory· Published Nov 8, 2026

CVE-2026-123575

Description

Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.

Affected products

Hickory DNS/Hickory DNSllm-fuzzy
Range: <0.26.2

Patches

Vulnerability mechanics

References

github.com/hickory-dns/hickory-dns/security/advisories/GHSA-g5xf-qv55-wv37nvd
www.vulncheck.com/advisories/hickory-dns-before-0.26.2-doh-memory-exhaustion-via-incomplete-request-bodiesnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000