CVE-2026-123602

Name of the Vulnerable Software and Affected Versions hickory-recursor (affected versions not specified) hickory-resolver versions 0.26.0-beta.1 through 0.26.1

Description The DNS recursor is susceptible to ghost domain names attacks. This occurs because the system reuses child-side apex NS RRsets (Resource Record sets) cached from zone NS queries during iterative resolution. An attacker can maintain a stale RRset in the cache indefinitely by repeatedly querying a zone's NS records, allowing name servers to continue answering for a zone even after the parent has revoked their delegation.

Recommendations Update hickory-resolver to version 0.26.2 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for hickory-recursor.