---
id: "CVE-2026-123583"
page: "https://infrastack.ai/live/CVE-2026-123583"
kind: "vulnerability"
aliases: ["CVE-2026-123583"]
title: "Hickory DNS: recursive resolver accepts out-of-bailiwick records in negative responses"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns", "hickory-dns", "package", "rust", "self-hosted"]
not_affected_if: ["system-resolver", "trusted-upstream-only"]
published_at: "2026-11-08T02:16:52+00:00"
first_seen_at: "2026-11-08T02:21:13+00:00"
updated_at: "2026-11-08T02:25:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123583", "first_seen_at": "2026-11-08T02:21:13+00:00"}]
exploit_sources: []
---

# Hickory DNS: recursive resolver accepts out-of-bailiwick records in negative responses

Link for people: https://infrastack.ai/live/CVE-2026-123583 (this .md is for agents)

The recursive resolver in Hickory DNS does not filter out-of-bailiwick records in negative responses, so an attacker who can supply crafted negative responses can insert records for names it does not control. This can enable DNS cache poisoning and makes other DNSSEC verification flaws easier to exploit.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of `hickory-recursor` in Cargo.lock; affected versions are `0.25.0` through `0.25.2`.
- Check the version of `hickory-resolver` in Cargo.lock; affected versions are before `0.26.2`.

## Fix

- `hickory-resolver` `0.26.2` (fixed version from the description; the sources do not give a fixed `hickory-recursor` release)

## Timeline

- 2026-11-08T02:21:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123583

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vcjp-57rr-mpfw
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-0.25.0-through-0.25.2-missing-bailiwick-filtering-on-negative-responses

## From the sources

The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache poisoning and more easily exploit other DNSSEC verification flaws.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_