CVE-2026-123603Medium· 6.5▾ Sunlithickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.
hickory-dns >= 0.25.0-alpha.3 <= 0.26.0-alpha.1hickory-dns >= 0.26.0 < 0.26.2hickory-dns >= 0.26.0 < 0.26.2hickory-dns >= 0.25.0-alpha.1 < 0.26.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123576High· 7.5Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests
CVE-2026-123571High· 7.5Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding
CVE-2026-123572High· 7.5Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser
CVE-2026-123570High· 7.5Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts
CVE-2026-123574High· 7.5Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser
CVE-2026-123573High· 7.5hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser