GHSA-4jwp-xjwm-333g: Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass

Published Nov 8, 2026

Updated

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking denyanswers, denyserver, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-proto, hickory-resolver, hickory-server to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are realistically exposed to this bypass?

Deployments are exposed if they use the affected packages and rely on deny_answers, deny_server, or AccessControlSet rules that distinguish IPv4 clients or destinations. Hickory-server library deployments using dual-stack IPv6 sockets can be reached by clients that should be denied.

What does an attacker need to exploit the issue?

An attacker needs to use an IPv4-mapped IPv6 address in a path where one of the affected access-control or filtering checks is enforced. This can evade answer filtering, cause queries to denied nameservers, or bypass client-deny rules on affected dual-stack server sockets.

Which versions need remediation?

hickory-proto and hickory-resolver versions 0.26.0 before 0.26.2 are affected. hickory-server versions from 0.25.0-alpha.1 before 0.26.2, and hickory-recursor versions 0.25.0-alpha.3 through 0.26.0-alpha.1, are also affected.

GHSA-4jwp-xjwm-333g: Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to this bypass?

What does an attacker need to exploit the issue?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this bypass?

What does an attacker need to exploit the issue?

Which versions need remediation?