---
id: GHSA-6f2x-v7q7-m7m5
title: hickory-resolver follows irrelevant CNAME records
summary: hickory-resolver follows irrelevant CNAME records
severity: medium
cwe:
  - CWE-400
vendor: hickory-resolver
product: hickory-resolver
ecosystem: rust
affected:
  - 'hickory-resolver >= 0.25.0, < 0.26.2'
patched:
  - hickory-resolver 0.26.2
published: '2026-10-05'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T22:55:20Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6f2x-v7q7-m7m5'
references:
  - url: >-
      https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5
  - url: 'https://github.com/hickory-dns/hickory-dns/pull/3871'
  - url: >-
      https://github.com/hickory-dns/hickory-dns/commit/4689fc8d3ddd3e3f99ec1b7be4e2e9e78afd2e6b
  - url: >-
      https://github.com/hickory-dns/hickory-dns/commit/ccd6952378f250c714fc2af0cb1053e1c179f832
  - url: 'https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2'
  - url: 'https://github.com/advisories/GHSA-6f2x-v7q7-m7m5'
tags:
  - ghsa
  - rust
ingestedAt: '2026-10-05T23:36:21.171Z'
---

## Overview

When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records that are not part of a CNAME chain starting from the original recursive query name, queries will be sent for those names. This increases query amplification beyond what is necessary to answer the recursive query.

## Affected packages

- `hickory-resolver >= 0.25.0, < 0.26.2`

## Remediation

Upgrade to a patched release:

- `hickory-resolver 0.26.2`