CVE-2026-123603 PUBLISHED

Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass

Assigner: VulnCheck
Reserved: 06.11.2026 Published: 08.11.2026 Updated: 08.11.2026

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor hickory-dns
Product hickory-dns
Versions Default: unaffected
  • affected from 0.25.0-alpha.3 to 0.26.0-alpha.1 (incl.)
Vendor hickory-dns
Product hickory-dns
Versions Default: unaffected
  • affected from 0.26.0 to 0.26.2 (excl.)
  • Version 0.26.2 is unaffected
Vendor hickory-dns
Product hickory-dns
Versions Default: unaffected
  • affected from 0.26.0 to 0.26.2 (excl.)
  • Version 0.26.2 is unaffected
Vendor hickory-dns
Product hickory-dns
Versions Default: unaffected
  • affected from 0.25.0-alpha.1 to 0.26.2 (excl.)
  • Version 0.26.2 is unaffected

Credits

  • qifan-sailboat reporter

References

Problem Types

  • Improper Access Control CWE