DEBIAN-CVE-2026-123602: Medium severity debian/rust-hickory-recursor vulnerability
The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.3-1 - Upgrade
Upgrade
hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must repeatedly query a zone's NS records to keep a stale child-side apex NS RRset in the recursor cache. This can allow name servers whose delegation was revoked by the parent to continue answering for that zone.
Which deployments are affected?
All versions of hickory-recursor are affected. Hickory-resolver is affected from 0.26.0-beta.1 through versions before 0.26.2 when the recursor feature is enabled.
What is the impact of a successful attack?
The affected resolver can continue using name servers for a zone after the parent has revoked their delegation. This can compromise the integrity of DNS resolution for the affected zone.