DEBIAN-CVE-2026-123603: Medium severity debian/rust-hickory-proto vulnerability

Q: Which deployments are exposed to this bypass?

Deployments using deny_answers, deny_server, or AccessControlSet rules are affected if those rules are expected to apply consistently to IPv4 clients or addresses. Hickory-server library deployments listening on dual-stack IPv6 sockets can also be reached by clients that should be denied.

Q: What does an attacker need to exploit the issue?

An attacker needs network access to the affected service or resolver and can use an IPv4-mapped IPv6 address. No authentication or user interaction is required according to the supplied severity vector.

Q: What can an attacker achieve?

An attacker can evade answer filtering, cause queries to nameservers that were intended to be denied, or access affected dual-stack hickory-server deployments from denied clients. The reported impact includes low confidentiality and integrity impact, with no availability impact.

Q: Which versions are affected?

Affected versions are hickory-proto and hickory-resolver 0.26.0 before 0.26.2; hickory-server 0.25.0-alpha.1 before 0.26.2; and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1.

Published Nov 8, 2026

Updated

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking denyanswers, denyserver, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.

Affected Software

8 affected componentsFixes available

debian/rust-hickory-proto*

debian/rust-hickory-proto<0.26.3-1

0.26.3-1

debian/rust-hickory-recursor*

debian/rust-hickory-resolver*

debian/rust-hickory-resolver<0.26.3-1

0.26.3-1

debian/rust-hickory-server*

debian/rust-hickory-server<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-proto to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade debian/rust-hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade debian/rust-hickory-server to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade hickory-proto to a version that resolves this vulnerability.
Fixed in 0.26.2
Upgrade
Upgrade hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.2
Upgrade
Upgrade hickory-server to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this bypass?

Deployments using deny_answers, deny_server, or AccessControlSet rules are affected if those rules are expected to apply consistently to IPv4 clients or addresses. Hickory-server library deployments listening on dual-stack IPv6 sockets can also be reached by clients that should be denied.

What does an attacker need to exploit the issue?

An attacker needs network access to the affected service or resolver and can use an IPv4-mapped IPv6 address. No authentication or user interaction is required according to the supplied severity vector.

What can an attacker achieve?

An attacker can evade answer filtering, cause queries to nameservers that were intended to be denied, or access affected dual-stack hickory-server deployments from denied clients. The reported impact includes low confidentiality and integrity impact, with no availability impact.

Which versions are affected?

Affected versions are hickory-proto and hickory-resolver 0.26.0 before 0.26.2; hickory-server 0.25.0-alpha.1 before 0.26.2; and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1.

DEBIAN-CVE-2026-123603: Medium severity debian/rust-hickory-proto vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this bypass?

What does an attacker need to exploit the issue?

What can an attacker achieve?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this bypass?

What does an attacker need to exploit the issue?

What can an attacker achieve?

Which versions are affected?