CVE-2026-123583Low· 3.7▾ SunlitThe recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache poisoning and more easily exploit other DNSSEC verification flaws.
hickory-dns >= 0.25.0 <= 0.25.2hickory-dns >= 0.26.0 < 0.26.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123576High· 7.5Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests
CVE-2026-123571High· 7.5Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding
CVE-2026-123572High· 7.5Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser
CVE-2026-123570High· 7.5Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts
CVE-2026-123574High· 7.5Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser
CVE-2026-123573High· 7.5hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser