CVE-2026-123583

Name of the Vulnerable Software and Affected Versions hickory-recursor versions 0.25.0 through 0.25.2 hickory-resolver versions 0.26.0 through 0.26.1

Description The recursive resolver fails to apply out-of-bailiwick filtering to negative responses. This allows attackers to provide crafted negative responses containing out-of-bailiwick records, which can be used to facilitate cache poisoning and exploit DNSSEC verification flaws. Out-of-bailiwick filtering is a security mechanism that ensures a DNS server only accepts records that are authoritative for the zone being queried.

Recommendations Update hickory-recursor to a version later than 0.25.2. Update hickory-resolver to version 0.26.2 or later.