UBUNTU-CVE-2026-123598: Medium severity ubuntu/rust-hickory-resolver vulnerability
The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2 - Upgrade
Upgrade
hickory-netto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker must be able to spoof an authoritative DNS response and supply an invalid DNSSEC signature with a long record TTL. Exploitation does not require privileges or user interaction, but the attack complexity is high.
What is the practical impact on affected resolvers?
A successfully injected DNSSEC-bogus answer can remain cached for up to 24 hours because the cache uses the attacker-supplied TTL, subject to that cap. The stated impact is reduced availability; confidentiality and integrity are not affected.
Which package versions are affected?
Affected ranges are hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2. Ubuntu lists rust-hickory-resolver, rust-hickory-recursor, and rust-hickory-net as affected software.