Cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aenaleantuleapcommunity/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 06 Oct 2026 00:46:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgResource Exhaustion in hickory-resolver via Unbounded TC-Retry Loophttps://feed.craftedsignal.io/briefs/2026-10-hickory-resolver-dos/Tue, 06 Oct 2026 00:46:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-hickory-resolver-dos/The hickory-resolver DNS library is vulnerable to a denial-of-service condition (CVE-2025-27150) where a malicious authoritative nameserver can induce an infinite retry loop by returning truncated responses.The hickory-resolver library, a popular DNS resolver implementation in Rust, contains a logic flaw within the NameServerPool::try_send function that allows for resource exhaustion. When the resolver receives a DNS response with the TC (truncated) flag set, it is programmed to retry the request using a different transport mechanism. However, the implementation fails to verify the transport state that previously provided the response and lacks a retry counter. Consequently, if a malicious authoritative nameserver sends a constant stream of responses with the TC=1 bit set, the resolver enters an infinite loop, attempting to retry the request until the 5-second wall-clock deadline expires. This behavior leads to CPU and network resource exhaustion, effectively preventing the resolver from processing legitimate DNS queries for the duration of the timeout.

Impact

Successful exploitation results in a Denial-of-Service (DoS) condition for applications relying on the hickory-resolver crate for DNS resolution. The vulnerability is highly relevant for network services, proxies, and infrastructure components that perform frequent outbound DNS queries, as attackers operating malicious authoritative nameservers can cause significant resolution latency or service outages.

Recommendation

  • Upgrade the hickory-resolver crate to version 0.26.2 or later to include the mandatory retry counter and transport validation logic.
  • Review network infrastructure logs for abnormal spikes in UDP/TCP traffic originating from external DNS nameservers associated with high latency or timeout errors.
  • Audit services utilizing versions 0.26.0-beta.1 through 0.26.1 for increased CPU usage or unresponsive DNS resolution threads.
]]>mediumadvisorydenial-of-servicednsrustcve-2025-27150