CVE-2026-123598

EUVD-2026-119357

08.11.2026, 02:16

The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.7 LOW	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 18.62%

Debian Releases

Debian Product

Codename

rust-hickory-net

forky	0.26.3-1 fixed
sid	0.26.3-1 fixed

rust-hickory-recursor

forky	vulnerable
sid	vulnerable
trixie	vulnerable

rust-hickory-resolver

forky	0.26.3-1 fixed
sid	0.26.3-1 fixed
trixie	vulnerable

Common Weakness Enumeration

CWE-613 - Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-29q9-p769-j8gq

https://www.vulncheck.com/advisories/hickory-dns-0.25.0-through-0.26.0-alpha.1-dnssec-bogus-answer-cache-poisoning