CVE-2026-123583 · Package
NO FIX YET · SEE WHAT TO DO
The recursive resolver in Hickory DNS does not filter out-of-bailiwick records in negative responses, so an attacker who can supply crafted negative responses can insert records for names it does not control. This can enable DNS cache poisoning and makes other DNSSEC verification flaws easier to exploit.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed the Hickory recursive resolver (hickory-recursor or hickory-resolver) to perform DNS lookups are exposed, most of all when they run recursion themselves and accept responses from networks an attacker can influence. Applications that only use the system resolver or a trusted upstream DNS service do not load this code path and can skip it.
Not affected if system-resolver, trusted-upstream-only
Who cares dns, hickory-dns, rust, self-hosted
hickory-recursor in Cargo.lock; affected versions are 0.25.0 through 0.25.2.hickory-resolver in Cargo.lock; affected versions are before 0.26.2.hickory-resolver 0.26.2 (fixed version from the description; the sources do not give a fixed release)The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache poisoning and more easily exploit other DNSSEC verification flaws.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hickory-recursor