CVE-2026-123598 PUBLISHED

Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning

Assigner: VulnCheck
Reserved: 06.11.2026 Published: 08.11.2026 Updated: 08.11.2026

The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.3

Product Status

Vendor hickory-dns
Product hickory-dns
Versions Default: unaffected
  • affected from 0.25.0 to 0.26.0-alpha.1 (incl.)
Vendor hickory-dns
Product hickory-dns
Versions Default: unaffected
  • affected from 0.26.0-alpha.1 to 0.26.2 (excl.)
  • Version 0.26.2 is unaffected
Vendor hickory-dns
Product hickory-dns
Versions Default: unaffected
  • affected from 0.26.0-beta.1 to 0.26.2 (excl.)
  • Version 0.26.2 is unaffected

Credits

  • qifan-sailboat reporter

References

Problem Types

  • Insufficient Session Expiration CWE