CVE-2026-123602: Security vulnerability

Published Nov 8, 2026

Updated

The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

All versions of hickory-recursor are affected. hickory-resolver is affected when the recursor feature is enabled in versions from 0.26.0-beta.1 before 0.26.2.

What must an attacker do to exploit the issue?

An attacker repeatedly queries a zone's NS records to keep a stale child-side apex NS RRset cached indefinitely. This can allow name servers whose delegation was revoked by the parent zone to continue answering for that zone.

Is hickory-resolver affected in its default configuration?

The provided information identifies hickory-resolver as affected only with the recursor feature enabled. It does not state whether that feature is enabled by default.

CVE-2026-123602: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to exploit the issue?

Is hickory-resolver affected in its default configuration?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to exploit the issue?

Is hickory-resolver affected in its default configuration?