Description
The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.
Published: 2026-11-08
Score: 8.2 High
EPSS: n/a
KEV: No
Impact: Incorrect DNS Resolution from Ghost Domains
Action: Immediate Patch
AI Analysis

Impact

The Hickory DNS recursor improperly reuses child‑side apex NS RRsets that were cached after initial zone NS queries. This weakness, corresponding to CWE‑672, allows an attacker to repeatedly query NS records for a zone, causing stale RRsets to be cached indefinitely and leading the recursor to continue answering for domains whose delegations have been revoked. The result is that DNS queries for ghost domains are resolved to incorrect name servers, undermining the integrity of DNS resolution.

Affected Systems

All releases of the Hickory DNS recursor, including the hickory‑resolver 0.26.0‑beta.1 through 0.26.1, are impacted. The defect was corrected in recursor 0.26.2 and later versions, which remove the problematic caching of child‑side apex NS RRsets.

Risk and Exploitability

The vulnerability receives a high CVSS score of 8.2, indicating significant potential impact. While no EPSS score is available, the lack of a KEV listing does not diminish the urgency. Attackers can exploit the flaw by sending ordinary DNS queries over the network; repeated iterative requests for a zone’s NS records keep the stale response cached for an indefinite period, allowing ghost domain resolution. The ease of exploitation and the clear impact on DNS integrity make this a substantial risk for any system running the affected versions.

Generated by OpenCVE AI on November 8, 2026 at 03:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Hickory DNS recursor to 0.26.2 or newer, which eliminates the faulty caching behavior.
  • If an upgrade is temporarily impractical, reconfigure the recursor to disable caching of child‑side apex NS RRsets or set their TTL to a very short value.
  • Apply DNS query rate limiting and monitor for abnormal NS query patterns to detect attempted ghost domain attacks.

Generated by OpenCVE AI on November 8, 2026 at 03:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 01:45:00 +0000

Type Values Removed Values Added
Description The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.
Title Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Caching
Weaknesses CWE-672
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-08T01:38:30.008Z

Reserved: 2026-11-06T01:00:16.506Z

Link: CVE-2026-123602

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-08T02:16:54.960

Modified: 2026-11-08T02:16:54.960

Link: CVE-2026-123602

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T03:15:08Z

Weaknesses
  • CWE-672

    Operation on a Resource after Expiration or Release