GHSA-29q9-p769-j8gq: Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning
Published Nov 8, 2026
·Updated
The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2 - Upgrade
Upgrade
hickory-netto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Nov 8, 2026
CVE Published
via OSV·01:38 AM
Data Sourced
via OSV·01:38 AM
DescriptionSeverityWeakness