{"id":"CVE-2026-123583","kind":"vulnerability","aliases":["CVE-2026-123583"],"related":[],"title":"Hickory DNS: recursive resolver accepts out-of-bailiwick records in negative responses","description":"The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache poisoning and more easily exploit other DNSSEC verification flaws.","summary":"The recursive resolver in Hickory DNS does not filter out-of-bailiwick records in negative responses, so an attacker who can supply crafted negative responses can insert records for names it does not control. This can enable DNS cache poisoning and makes other DNSSEC verification flaws easier to exploit.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","package","rust","self-hosted"],"not_affected_if":["system-resolver","trusted-upstream-only"],"how_to_check":"- Check the version of `hickory-recursor` in Cargo.lock; affected versions are `0.25.0` through `0.25.2`.\n- Check the version of `hickory-resolver` in Cargo.lock; affected versions are before `0.26.2`.","fix":"- `hickory-resolver` `0.26.2` (fixed version from the description; the sources do not give a fixed `hickory-recursor` release)","status":"open","published_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:25:01+00:00","updated_at":"2026-11-08T02:25:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:25:01Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-resolver` `0.26.2` (fixed version from the description; the sources do not give a fixed `hickory-recursor` release)","reach":"network","title":"Hickory DNS: recursive resolver accepts out-of-bailiwick records in negative responses","impact":"medium","summary":"The recursive resolver in Hickory DNS does not filter out-of-bailiwick records in negative responses, so an attacker who can supply crafted negative responses can insert records for names it does not control. This can enable DNS cache poisoning and makes other DNSSEC verification flaws easier to exploit.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dns","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"DNS cache poisoning redirects names to attacker-chosen addresses","analyst_note":"Confirm the fixed hickory-recursor version and the vendor advisory on github.com; the sources only give the fixed hickory-resolver version.","how_to_check":"- Check the version of `hickory-recursor` in Cargo.lock; affected versions are `0.25.0` through `0.25.2`.\n- Check the version of `hickory-resolver` in Cargo.lock; affected versions are before `0.26.2`.","plain_action":"","needs_analyst":true,"not_affected_if":["system-resolver","trusted-upstream-only"],"who_is_affected":"Applications that embed the Hickory recursive resolver (hickory-recursor or hickory-resolver) to perform DNS lookups are exposed, most of all when they run recursion themselves and accept responses from networks an attacker can influence. Applications that only use the system resolver or a trusted upstream DNS service do not load this code path and can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000761,"input_tokens":4321,"output_tokens":657,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123583':16A,19A '-2026':15A,18A '0.25.0':88C '0.25.2':90C '0.26.0':95C '0.26.2':97C 'abl':110C 'accept':5A 'appli':100C 'attack':48B,109C 'bailiwick':9A,41B,104C,121C 'cach':68B,125C 'control':63B 'craft':52B,113C 'cve':14A,17A 'dns':2A,20B,23B,34B,67B,84C 'dnssec':73B,132C 'easier':76B 'easili':129C 'enabl':66B 'exploit':78B,130C 'facilit':124C 'filter':37B,105C 'flaw':75B,134C 'hickori':1A,22B,33B,83C,86C,93C 'hickory-dn':21B 'hickory-recursor':85C 'hickory-resolv':92C 'host':28B 'includ':117C 'insert':56B 'make':71B 'name':59B 'negat':12A,44B,53B,107C,114C 'out-of-bailiwick':6A,38B,101C,118C 'packag':24B 'poison':69B,126C 'record':10A,42B,57B,122C 'recurs':3A,30B,80C 'recursor':87C 'resolv':4A,31B,81C,94C 'respons':13A,45B,54B,108C,115C 'rust':25B 'self':27B 'self-host':26B 'suppli':51B,112C 'verif':74B,133C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed the Hickory recursive resolver (hickory-recursor or hickory-resolver) to perform DNS lookups are exposed, most of all when they run recursion themselves and accept responses from networks an attacker can influence. Applications that only use the system resolver or a trusted upstream DNS service do not load this code path and can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","medium","package","rust","selfhosted"],"campaign_type":null,"search_a":"'-123583':16A,19A '-2026':15A,18A 'accept':5A 'bailiwick':9A 'cve':14A,17A 'dns':2A 'hickori':1A 'negat':12A 'out-of-bailiwick':6A 'record':10A 'recurs':3A 'resolv':4A 'respons':13A","search_b":"'attack':48B 'bailiwick':41B 'cach':68B 'control':63B 'craft':52B 'dns':20B,23B,34B,67B 'dnssec':73B 'easier':76B 'enabl':66B 'exploit':78B 'filter':37B 'flaw':75B 'hickori':22B,33B 'hickory-dn':21B 'host':28B 'insert':56B 'make':71B 'name':59B 'negat':44B,53B 'out-of-bailiwick':38B 'packag':24B 'poison':69B 'record':42B,57B 'recurs':30B 'resolv':31B 'respons':45B,54B 'rust':25B 'self':27B 'self-host':26B 'suppli':51B 'verif':74B","search_c":"'0.25.0':88C '0.25.2':90C '0.26.0':95C '0.26.2':97C 'abl':110C 'appli':100C 'attack':109C 'bailiwick':104C,121C 'cach':125C 'craft':113C 'dns':84C 'dnssec':132C 'easili':129C 'exploit':130C 'facilit':124C 'filter':105C 'flaw':134C 'hickori':83C,86C,93C 'hickory-recursor':85C 'hickory-resolv':92C 'includ':117C 'negat':107C,114C 'out-of-bailiwick':101C,118C 'poison':126C 'record':122C 'recurs':80C 'recursor':87C 'resolv':81C,94C 'respons':108C,115C 'suppli':112C 'verif':133C","first_public_at":"2026-09-03T21:42:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123583","severity":null,"published_at":"2026-11-08T02:16:52+00:00","modified_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99317,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vcjp-57rr-mpfw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:42:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99318,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.25.0-through-0.25.2-missing-bailiwick-filtering-on-negative-responses","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}