CVE-2026-123598Low· 3.7▾ SunlitThe validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.
hickory-dns >= 0.25.0 <= 0.26.0-alpha.1hickory-dns >= 0.26.0-alpha.1 < 0.26.2hickory-dns >= 0.26.0-beta.1 < 0.26.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123597Low· 3.7Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors
CVE-2026-123576High· 7.5Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests
CVE-2026-123571High· 7.5Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding
CVE-2026-123572High· 7.5Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser
CVE-2026-123570High· 7.5Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts
CVE-2026-123574High· 7.5Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser