CVE-2026-123603

Name of the Vulnerable Software and Affected Versions hickory-proto versions 0.26.0 through 0.26.1 hickory-resolver versions 0.26.0 through 0.26.1 hickory-server versions 0.25.0-alpha.1 through 0.26.1 hickory-recursor versions 0.25.0-alpha.3 through 0.26.0-alpha.1

Description The software fails to canonicalize IPv4-mapped IPv6 addresses when evaluating deny answers, deny server, or AccessControlSet rules. This allows attackers to use IPv4-mapped addresses to bypass answer filtering, force queries to denied nameservers, or access hickory-server library deployments on dual-stack IPv6 sockets from restricted clients.

Recommendations Update hickory-proto to version 0.26.2 or later. Update hickory-resolver to version 0.26.2 or later. Update hickory-server to version 0.26.2 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for hickory-recursor.