Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2026-123582

Hickory DNS 0.25.0 before 0.26.2 DNSSEC Validation Bypass via SOA Record

The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the SOA record passed DNSSEC validation when assembling NXDOMAIN or NODATA responses. An attacker able to supply forged DNS responses can have a forged SOA record returned to clients with the AD bit set, misleading clients that rely on the server's DNSSEC validation.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123583

Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responses

The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache poisoning and more easily exploit other DNSSEC verification flaws.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123584

Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses

The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed responses to abort client queries, causing denial of service.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123586

Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals

Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue records can make the recursor loop, sending many upstream queries, amplified further by zero-TTL NS records.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123587

Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC

The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123588

Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool

The recursive resolver in Hickory DNS (all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2) caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS responses can make these lookups fail, causing all subsequent queries for the affected zone to fail until the cache entry expires or is evicted.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123590

Hickory DNS 0.26.0-beta.1 before 0.26.2 Improper NSEC/NSEC3 Signature Validation

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123591

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 fail to verify, per RFC 6840 §4.4, that an NSEC or NSEC3 record denying a DS RRset also proves the delegation's NS record exists. Attackers can reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123592

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision

The hickory-net crate in Hickory DNS 0.26.0-beta.1 before 0.26.2 allows DNSSEC validation bypass because Name's Hash ignores label lengths and ValidationCacheKey compares only that hash. An attacker controlling an unsigned delegation whose name differs from a signed target only in dot positions can prime an Insecure verdict, causing forged answers for the target to skip signature verification instead of returning SERVFAIL.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123594

Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually proves the name exists as an empty non-terminal. On-path attackers can flip the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN, causing validators to accept forged nonexistence of the name.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123595

Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123596

Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. An on-path attacker, rogue parent nameserver, or attacker winning a port and TXID race can deliver one forged NXDOMAIN response built from genuinely signed parent NSEC records, causing authenticated denial of existing child-zone names cached for the negative TTL.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123598

Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning

The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123599

Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123600

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123602

Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching

The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123603

Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123604

Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop

Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on every transport keeps the resolver spinning on a persistent TCP connection until the 5-second request deadline expires, causing resource exhaustion.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123606

Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification

The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123607

Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXDomain responses with a cross-zone SOA record to panic debug builds or exhaust memory in release builds.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns