CVE-2026-42254

MediumCVSS 4.0

Published: 26/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with the query that triggered a response.

Risk Assessment

An attacker could poison the DNS resolver cache and redirect users to malicious resources. This may lead to phishing or traffic interception.

Recommendation

Update hickory-recursor to a version later than 0.25.2. Monitor for anomalous DNS responses and consider DNSSEC validation.

Other vulnerabilities in hickory-recursor

CVE-2026-123606High
The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force A and AAAA lookups per target, amplifying traffic against remote servers or exhausting recursor resources.

Original NVD description (English source)

Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS