Dashboard / CVE-2026-123584

CVE-2026-123584

HIGH
MEDIUM Priority: 0.03 BB Relevance: 66/100
Published: 2026-11-08 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: X
AT: Present
VC: None
VI: None
VA: High

Description

The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
hickory-dns hickory-dns 0.26.0 < 0.26.2

References & Advisories (2)

Bug Bounty Relevance

66 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

8.2 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.37%
Raw Score 0.003670
Percentile 30.8%
Date 2026-11-08

Intelligence Sources

mitre ref →
nvd ref →

External Links