CVE-2026-123598

Name of the Vulnerable Software and Affected Versions hickory-recursor versions 0.25.0 through 0.26.0-alpha.1 hickory-resolver versions 0.26.0-alpha.1 through 0.26.1 hickory-net versions 0.26.0-beta.1 through 0.26.1

Description The validating recursor caches DNSSEC-bogus answers using the untrusted record TTL (Time To Live) provided by an attacker, which can be as long as 24 hours, rather than using a short validation-failure TTL. This allows a remote attacker to spoof an authoritative response with an invalid signature and a long TTL, causing the bogus result to remain cached for up to 24 hours.

Recommendations Update hickory-recursor to a version later than 0.26.0-alpha.1. Update hickory-resolver to version 0.26.2 or later. Update hickory-net to version 0.26.2 or later.