CVE-2026-123583: Security vulnerability

Published Nov 8, 2026

Updated

The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache poisoning and more easily exploit other DNSSEC verification flaws.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using hickory-recursor versions 0.25.0 through 0.25.2, or hickory-resolver versions 0.26.0 before 0.26.2, are affected.

What does an attacker need to exploit this issue?

An attacker must be able to supply crafted negative DNS responses. Those responses can carry out-of-bailiwick records that may facilitate DNS cache poisoning and make other DNSSEC verification flaws easier to exploit.

How can I determine whether I may already be exposed?

Identify the Hickory DNS resolver component and version in use. Exposure applies to hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2.

CVE-2026-123583: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I determine whether I may already be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I determine whether I may already be exposed?