UBUNTU-CVE-2026-123583: Medium severity ubuntu/rust-hickory-resolver vulnerability
The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache poisoning and more easily exploit other DNSSEC verification flaws.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
Which package versions are affected?
Affected versions are hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2.
What must an attacker be able to do to exploit this issue?
An attacker must be able to supply crafted negative DNS responses to the recursive resolver. Those responses can contain out-of-bailiwick records that are not filtered.
What is the security impact?
The flaw can facilitate DNS cache poisoning by allowing out-of-bailiwick records in negative responses. It can also make other DNSSEC verification flaws easier to exploit.