UBUNTU-CVE-2026-123602: High severity ubuntu/rust-hickory-resolver vulnerability
The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be performed over the network and does not require privileges or user interaction. It requires repeatedly querying a zone's NS records to keep a stale NS RRset cached.
What is the practical effect of a successful attack?
Name servers whose delegation has been revoked by the parent can continue to be used to answer for the affected zone. The reported impact is integrity-related; confidentiality and availability impacts are not indicated.