hickory-dns has 40 CVEs on record. Disclosure cadence is accelerating: 40 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 39. The median CVSS is 6.7 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-345 (7) and CWE-400 (4). Most affected products: hickory-dns (39), hickory-resolver (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.7
- Publish → KEV
- —
- Last 90 days
- 40 prev 0
Products
- hickory-dns 39
- hickory-resolver 1
Worst active — by depth score
CVE-2026-123605High· 8.8Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name48CVE-2026-123596High· 8.8Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC48CVE-2026-123595High· 8.8Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC348CVE-2026-123608High· 7.5Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression41CVE-2026-123607High· 7.5Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service41
hickory-dns vulnerabilities
CVEs affecting hickory-dns, newest first. Open any entry for full detail, references, and exploit status.
40 CVEsRSS
CVE-2026-123597Low· 3.7Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors
Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker …
CVE-2026-123602Medium· 5.9Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching
The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone …
CVE-2026-123600Medium· 4.8Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without a…
CVE-2026-123599Low· 3.7Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records
Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are mar…
CVE-2026-123606High· 7.5Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification
The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote a…
CVE-2026-123603Medium· 6.5Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass
hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, …
CVE-2026-123607High· 7.5Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. …
CVE-2026-123605High· 8.8Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name
Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without …
CVE-2026-123608High· 7.5Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression
Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages wi…
CVE-2026-93657High· 7.5hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the a…