{"id":"CVE-2026-123602","kind":"vulnerability","aliases":["CVE-2026-123602"],"related":[],"title":"Hickory DNS recursor keeps revoked name servers answering for zones","description":"The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.","summary":"The Hickory DNS recursor reuses child-side apex NS records cached from zone queries, so stale records persist. An attacker who keeps querying a zone's NS records keeps retired name servers answering for that zone, the ghost domain name attack.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","package","recursor","rust"],"not_affected_if":["recursor-feature-disabled"],"how_to_check":"- Check the installed `hickory-resolver` or `hickory-recursor` version in your lockfile or `Cargo.lock`\n- Confirm whether the recursor feature is enabled in your build configuration","fix":"- `hickory-resolver` `0.26.2` or later (fixed version for 0.26.0-beta.1 branch per the description)\n- hickory-recursor: unknown","status":"open","published_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","triaged_at":"2026-11-08T02:23:15+00:00","updated_at":"2026-11-08T02:23:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:23:15Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-resolver` `0.26.2` or later (fixed version for 0.26.0-beta.1 branch per the description)\n- hickory-recursor: unknown","reach":"network","title":"Hickory DNS recursor keeps revoked name servers answering for zones","impact":"medium","summary":"The Hickory DNS recursor reuses child-side apex NS records cached from zone queries, so stale records persist. An attacker who keeps querying a zone's NS records keeps retired name servers answering for that zone, the ghost domain name attack.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","dns","hickory-dns","recursor"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker-chosen name servers answer DNS queries for a zone","analyst_note":"Confirm the fixed version for hickory-recursor itself and whether the vendor advisory at github.com lists it; the sources only state the resolver fix.","how_to_check":"- Check the installed `hickory-resolver` or `hickory-recursor` version in your lockfile or `Cargo.lock`\n- Confirm whether the recursor feature is enabled in your build configuration\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["recursor-feature-disabled"],"who_is_affected":"Applications built on the Hickory DNS recursor (hickory-recursor, or hickory-resolver 0.26.0-beta.1 with the recursor feature enabled) can return answers from name servers the parent zone has revoked. Systems that use the default resolver configuration or do not enable the recursor feature are not described as affected. The sources do not say whether hickory-recursor has a fixed release.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4348,"output_tokens":636,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123602':13A,16A '-2026':12A,15A '0.26.0':82C '0.26.2':85C 'answer':8A,57B,137C 'apex':32B,101C 'attack':44B,65B,94C,121C 'beta.1':83C 'cach':35B,104C,126C 'child':30B,99C 'child-sid':29B,98C 'cve':11A,14A 'deleg':132C 'dns':2A,17B,20B,26B,68C 'domain':63B,92C 'featur':87C 'ghost':62B,91C 'hickori':1A,19B,25B,67C,75C,80C 'hickory-dn':18B 'hickory-recursor':74C 'hickory-resolv':79C 'indefinit':127C 'iter':110C 'keep':4A,46B,53B,122C,136C 'let':128C 'name':6A,55B,64B,93C,129C 'ns':33B,51B,102C,107C,118C 'packag':21B 'parent':134C 'persist':42B 'queri':38B,47B,108C,114C 'record':34B,41B,52B,119C 'recursor':3A,22B,27B,69C,76C,86C 'repeat':113C 'resolut':111C 'resolv':81C 'retir':54B 'reus':28B,97C 'revok':5A,135C 'rrset':103C,125C 'rust':23B 'server':7A,56B,130C 'side':31B,100C 'stale':40B,124C 'version':72C 'vulner':89C 'whose':131C 'zone':10A,37B,49B,60B,106C,116C,140C","nicknames":[],"mitigations":[],"who_affected":"Applications built on the Hickory DNS recursor (hickory-recursor, or hickory-resolver 0.26.0-beta.1 with the recursor feature enabled) can return answers from name servers the parent zone has revoked. Systems that use the default resolver configuration or do not enable the recursor feature are not described as affected. The sources do not say whether hickory-recursor has a fixed release.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","high","package","recursor","rust"],"campaign_type":null,"search_a":"'-123602':13A,16A '-2026':12A,15A 'answer':8A 'cve':11A,14A 'dns':2A 'hickori':1A 'keep':4A 'name':6A 'recursor':3A 'revok':5A 'server':7A 'zone':10A","search_b":"'answer':57B 'apex':32B 'attack':44B,65B 'cach':35B 'child':30B 'child-sid':29B 'dns':17B,20B,26B 'domain':63B 'ghost':62B 'hickori':19B,25B 'hickory-dn':18B 'keep':46B,53B 'name':55B,64B 'ns':33B,51B 'packag':21B 'persist':42B 'queri':38B,47B 'record':34B,41B,52B 'recursor':22B,27B 'retir':54B 'reus':28B 'rust':23B 'server':56B 'side':31B 'stale':40B 'zone':37B,49B,60B","search_c":"'0.26.0':82C '0.26.2':85C 'answer':137C 'apex':101C 'attack':94C,121C 'beta.1':83C 'cach':104C,126C 'child':99C 'child-sid':98C 'deleg':132C 'dns':68C 'domain':92C 'featur':87C 'ghost':91C 'hickori':67C,75C,80C 'hickory-recursor':74C 'hickory-resolv':79C 'indefinit':127C 'iter':110C 'keep':122C,136C 'let':128C 'name':93C,129C 'ns':102C,107C,118C 'parent':134C 'queri':108C,114C 'record':119C 'recursor':69C,76C,86C 'repeat':113C 'resolut':111C 'resolv':81C 'reus':97C 'revok':135C 'rrset':103C,125C 'server':130C 'side':100C 'stale':124C 'version':72C 'vulner':89C 'whose':131C 'zone':106C,116C,140C","first_public_at":"2026-09-03T21:21:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123602","severity":null,"published_at":"2026-11-08T02:16:54+00:00","modified_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","fetched_at":"2026-11-08T02:21:14+00:00","note":null}],"documents":[{"id":99355,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2hxp-x833-73f7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:21:16+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99356,"url":"https://www.vulncheck.com/advisories/hickory-dns-recursor-ghost-domain-attack-via-child-side-ns-rrset-caching","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}