{
  "cveId": "CVE-2026-123588",
  "url": "https://patchblox.com/security/cve/CVE-2026-123588",
  "summary": "CVE-2026-123588 is fixed in rust-hickory-resolver on 1 platform by DEBIAN-CVE-2026-123588 (version 0.26.3-1), released November 9, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "rust-hickory-resolver: The recursive resolver in Hickory DNS (all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before...",
  "description": "The recursive resolver in Hickory DNS (all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2) caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers\u0027 IP addresses fail. An attacker able to spoof DNS responses can make these lookups fail, causing all subsequent queries for the affected zone to fail until the cache entry expires or is evicted.",
  "published": "2026-11-08T02:16:52Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00343,
  "epssPercentile": 0.28134,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "rust-hickory-resolver",
      "release": "Debian 14",
      "fixedVersion": "0.26.3-1",
      "fix": "DEBIAN-CVE-2026-123588",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-123588",
      "released": "2026-11-09T02:18:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-11T01:43:54Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}