CVE-2026-123583
Received Received - Intake

DNS Cache Poisoning in Hickory DNS Resolver

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache poisoning and more easily exploit other DNSSEC verification flaws.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123583
EUVD
EUVD-2026-119342

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hickory-dns hickory-dns From 0.25.0 (inc) to 0.25.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-349 The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Hickory DNS's recursive resolver versions 0.25.0 to 0.25.2 and 0.26.0 before 0.26.2. It involves missing out-of-bailiwick filtering for negative responses, which are responses indicating a domain does not exist. Without this filtering, attackers can inject unauthorized records into responses, enabling cache poisoning and exploitation of DNSSEC flaws.

Detection Guidance

To detect this vulnerability, check the version of Hickory DNS running on your system. Affected versions are hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2. Use commands like 'cargo install --version' or check package managers for installed versions.

Impact Analysis

Attackers could exploit this to poison DNS caches, redirecting users to malicious sites. This may lead to phishing, data theft, or unauthorized access. Systems relying on Hickory DNS for resolution could be affected if using vulnerable versions.

Mitigation Strategies

Immediately upgrade to patched versions of Hickory DNS. For hickory-recursor, upgrade to versions beyond 0.25.2. For hickory-resolver, upgrade to 0.26.2 or later. If patches are unavailable, consider disabling the resolver or switching to an alternative DNS solution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123583. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...