PT-2026-35193 · Hickory Dns · Hickory-Recursor

CVE-2026-42254

Published

2026-04-26

Updated

2026-04-30

CVSS v4.0

8.7

High

Vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hickory DNS hickory-recursor versions 0.1 through 0.25.2

Description Cross-zone poisoning is possible because cached data is not directly associated with the query that triggered the response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2026-42254

GHSA-83HF-93M4-RGWQ

Hickory-Recursor