Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123598— Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning

Quick assessment

Affected
hickory-dns hickory-dns
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Hickory DNS 中，验证递归解析器（validating recursor）存在漏洞，影响以下版本：hickory-recursor 0.25.0 至 0.26.0-alpha.1、hickory-resolver 0.26.0-alpha.1（0.26.2 之前版本）以及 hickory-net 0.26.0-beta.1（0.26.2 之前版本）。该组件在缓存 DNSSEC 无效（bogus）响应时，使用了由攻击者提供且未经信任的记录生存时间（TTL）（上限为 24 小时），而非采用较短的验证失败

CVSS 3.7 · Low

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123598

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning
Source: CVE Program / CVE List V5
Vulnerability Description
The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
hickory-dns hickory-dns 0.25.0 ~ 0.26.0-alpha.1 -
hickory-dns hickory-dns 0.26.0-alpha.1 ~ 0.26.2 -
hickory-dns hickory-dns 0.26.0-beta.1 ~ 0.26.2 -

II. Public POCs for CVE-2026-123598

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123598

请登录查看更多情报信息。

Other References for CVE-2026-123598 (2)

Same Patch Batch · hickory-dns · 2026-11-08 · 39 CVEs total

CVE-2026-123595 8.8 HIGH Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3
CVE-2026-123605 8.8 HIGH Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name
CVE-2026-123596 8.8 HIGH Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC
CVE-2026-123570 7.5 HIGH Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts
CVE-2026-123580 7.5 HIGH Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3
CVE-2026-123571 7.5 HIGH Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding
CVE-2026-123572 7.5 HIGH Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser
CVE-2026-123588 7.5 HIGH Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool
CVE-2026-123575 7.5 HIGH Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies
CVE-2026-123574 7.5 HIGH Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser
CVE-2026-123577 7.5 HIGH Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service
CVE-2026-123604 7.5 HIGH Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_se
CVE-2026-123576 7.5 HIGH Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests
CVE-2026-123573 7.5 HIGH hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser
CVE-2026-123607 7.5 HIGH Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service
CVE-2026-123606 7.5 HIGH Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification
CVE-2026-123608 7.5 HIGH Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compressi
CVE-2026-123586 7.5 HIGH Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals
CVE-2026-123587 6.8 MEDIUM Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC
CVE-2026-123601 6.5 MEDIUM Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: hickory-dns
Same vendor: hickory-dns
Same weakness: CWE-613