CVE-2026-123603 · Package
NO FIX YET · SEE WHAT TO DO
Several Hickory DNS Rust crates fail to normalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server and access control rules. An attacker can use such addresses to slip past DNS answer filtering, reach denied nameservers, or query a dual-stack hickory-server from clients it should block.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use the affected Hickory crates for DNS answer filtering, nameserver deny rules or access control. Exposure is highest where hickory-server runs on dual-stack IPv6 sockets and accepts clients that should be denied. Projects that do not use these crates or these deny and access rules can skip it.
Not affected if ipv4-only, no-deny-rules, not-using-hickory
Who cares dns, hickory, rust, self-hosted
Cargo.lock for hickory-proto, hickory-resolver, hickory-server and hickory-recursor.deny_answers, deny_server or AccessControlSet in your Hickory configuration and code.hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hickory-proto and hickory-resolver: 0.26.2 (from 0.26.0 before 0.26.2)hickory-server: 0.26.2 (from 0.25.0-alpha.1 before 0.26.2)hickory-recursor: unknown (affected range 0.25.0-alpha.3 through 0.26.0-alpha.1; the sources do not name a fixed version)