UBUNTU-CVE-2026-123603: Medium severity ubuntu/rust-hickory-proto vulnerability
hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking denyanswers, denyserver, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-prototo a version that resolves this vulnerability.Fixed in 0.26.2 - Upgrade
Upgrade
hickory-resolverto a version that resolves this vulnerability.Fixed in 0.26.2 - Upgrade
Upgrade
hickory-serverto a version that resolves this vulnerability.Fixed in 0.26.2 - Upgrade
Upgrade
hickory-recursorto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
Deployments using affected hickory components are exposed when they rely on deny_answers, deny_server, or AccessControlSet rules and accept or process IPv4-mapped IPv6 addresses. Hickory-server library deployments using dual-stack IPv6 sockets can also be reached by clients that should be denied.
What does an attacker need to exploit this issue?
An attacker needs network access and can exploit the issue without privileges or user interaction by using an IPv4-mapped IPv6 address. This can bypass answer filtering, cause queries to denied nameservers, or bypass client-deny rules in affected dual-stack server deployments.
Are default installations affected?
The issue depends on use of the affected deny_answers, deny_server, or AccessControlSet controls, or on hickory-server deployments using dual-stack IPv6 sockets with denied-client rules. The provided information does not establish whether these controls are enabled by default.
What can be done if updating is not immediately possible?
Avoid relying solely on the affected hickory address-based deny controls for IPv4 clients that may connect through IPv4-mapped IPv6 addresses. Restrict relevant client and nameserver access outside the affected rules until an update is available.