{"id":"CVE-2026-42254","aliases":["DEBIAN-CVE-2026-42254","EUVD-2026-25687","GHSA-2hfw-w5cw-p4g7","GHSA-83hf-93m4-rgwq","UBUNTU-CVE-2026-42254"],"status":"published","title":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data...","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00162,"percentile":0.05518,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345","CWE-706"],"published":"2026-04-26T02:38:41Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"crates.io","package":"hickory-recursor","fixed_in":["0.26.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"hickory-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0"},{"last_affected":"0.25.2"},{"fixed":"0.26.0"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"hickory-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1"},{"last_affected":"0.1"}]}],"versions":["0.1"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-hickory-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.1-1","0.25.2-1","0.25.2-2","0.25.2-3","0.25.2-4","0.25.2-5","0.25.2-6"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.1-1","0.25.2-1","0.25.2-2","0.25.2-3","0.25.2-4","0.25.2-5","0.25.2-6"]},{"source":"osv","ecosystem":"crates.io","package":"hickory-recursor","ranges":[{"type":"SEMVER","events":[{"introduced":"0.24.0"},{"fixed":"0.26.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hickory-recursor","versions":["0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-hickory-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.1-1","0.25.2-6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hickory-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.1-1"]}],"products":[{"vendor":"hickory project","product":"hickory dns"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-83hf-93m4-rgwq","tags":["advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42254","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2hfw-w5cw-p4g7"},{"url":"https://github.com/advisories/GHSA-83hf-93m4-rgwq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42254.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42254","tags":["advisory"]},{"url":"https://github.com/hickory-dns/hickory-dns","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-42254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42254","tags":["report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0106.html","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-42254","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","status":"published","published":"2026-04-26T02:38:41.261Z","modified":"2026-04-27T13:33:50.961Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-25687","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","status":"published","published":"2026-04-26T02:38:41Z","modified":"2026-04-27T13:33:50Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:17.84353Z"}],"ghsa":[{"id":"GHSA-2hfw-w5cw-p4g7","title":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data...","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","status":"published","published":"2026-04-26T03:30:25Z","modified":"2026-04-26T03:30:25Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T15:07:38.391524Z"},{"id":"GHSA-83hf-93m4-rgwq","title":"Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation","description":"# Summary\n\nThe Hickory DNS project's experimental `hickory-recursor` crate's record cache (`DnsLru`) stores records from DNS responses keyed by each record's own (name, type), not by the query that triggered the response. `cache_response()` in `crates/recursor/src/lib.rs` chains `ANSWER`, `AUTHORITY`, and `ADDITIONAL` sections into one record iterator before insertion. The bailiwick filter it applies uses the zone context of the NS pool that serviced the lookup, not the zone being queried.\n\nThis creates a cross-zone poisoning path. When Hickory builds the NS pool for `attacker.poc.` it uses the parent `poc.` `NS` pool (`ns.zone() = \"poc.\"`). If the `poc.` nameserver under the attacker's control includes in its response's `AUTHORITY` section a record for a sibling zone like `victim.poc. NS ns.evil.poc.`, the bailiwick check `is_subzone(\"poc.\", \"victim.poc.\")` passes (`victim.poc.` is a subdomain of `poc.`). The record is stored under `(victim.poc., NS)` in the shared cache.\n\nSubsequently, any client querying a name in `victim.poc`. causes Hickory to build its NS pool from the poisoned cache entry, routing queries to the attacker's nameserver (`ns.evil.poc.`) rather than to the legitimate nameserver for `victim.poc.`. The legitimate `NS` for that zone receives zero queries.\n\nThis issue is fixed in `hickory-resolver` 0.26.0 with the `recursor` feature through an architectural change to response-level caching: responses are stored keyed by the originating query `(name, type)`. A response to `(attacker.poc. NS)` is stored only under that key and cannot affect the `(victim.poc., NS)` cache entry.\n\nHickory DNS believes this issue has been present in all published versions of the experimental `hickory-recursor` crate, which has now been folded into the `hickory-resolver` crate under the non-default `recursor` feature flag. The `hickory-recursor` crate will not receive any updates going forward and all users should migrate to `hickory-resolver` with the `recursor` feature.\n\nUsers of the `hickory-dns` binary configured with the opt-in `recursor` feature and a configuration acting as a recursive resolver should update to 0.26.0+.\n\n### Reporter \n\nQifan Zhang, Palo Alto Networks","status":"published","published":"2026-04-30T18:10:58Z","modified":"2026-04-30T18:10:59Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-345","CWE-706"],"updated_at":"2026-11-02T14:39:59.776263Z"}],"nvd":[{"id":"CVE-2026-42254","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","status":"published","published":"2026-04-26T03:15:59.08Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T14:12:16.252509Z"}],"osv":[{"id":"CVE-2026-42254","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","status":"published","published":"2026-04-26T02:38:41.261Z","modified":"2026-10-28T02:30:33.593334922Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-42254","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","status":"published","published":"2026-04-26T03:15:59.08Z","modified":"2026-10-27T09:47:33.932985004Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-83hf-93m4-rgwq","title":"Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation","description":"# Summary\n\nThe Hickory DNS project's experimental `hickory-recursor` crate's record cache (`DnsLru`) stores records from DNS responses keyed by each record's own (name, type), not by the query that triggered the response. `cache_response()` in `crates/recursor/src/lib.rs` chains `ANSWER`, `AUTHORITY`, and `ADDITIONAL` sections into one record iterator before insertion. The bailiwick filter it applies uses the zone context of the NS pool that serviced the lookup, not the zone being queried.\n\nThis creates a cross-zone poisoning path. When Hickory builds the NS pool for `attacker.poc.` it uses the parent `poc.` `NS` pool (`ns.zone() = \"poc.\"`). If the `poc.` nameserver under the attacker's control includes in its response's `AUTHORITY` section a record for a sibling zone like `victim.poc. NS ns.evil.poc.`, the bailiwick check `is_subzone(\"poc.\", \"victim.poc.\")` passes (`victim.poc.` is a subdomain of `poc.`). The record is stored under `(victim.poc., NS)` in the shared cache.\n\nSubsequently, any client querying a name in `victim.poc`. causes Hickory to build its NS pool from the poisoned cache entry, routing queries to the attacker's nameserver (`ns.evil.poc.`) rather than to the legitimate nameserver for `victim.poc.`. The legitimate `NS` for that zone receives zero queries.\n\nThis issue is fixed in `hickory-resolver` 0.26.0 with the `recursor` feature through an architectural change to response-level caching: responses are stored keyed by the originating query `(name, type)`. A response to `(attacker.poc. NS)` is stored only under that key and cannot affect the `(victim.poc., NS)` cache entry.\n\nHickory DNS believes this issue has been present in all published versions of the experimental `hickory-recursor` crate, which has now been folded into the `hickory-resolver` crate under the non-default `recursor` feature flag. The `hickory-recursor` crate will not receive any updates going forward and all users should migrate to `hickory-resolver` with the `recursor` feature.\n\nUsers of the `hickory-dns` binary configured with the opt-in `recursor` feature and a configuration acting as a recursive resolver should update to 0.26.0+.\n\n### Reporter \n\nQifan Zhang, Palo Alto Networks","status":"published","published":"2026-04-30T18:10:58Z","modified":"2026-07-08T08:12:56.458992426Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-345","CWE-706"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"UBUNTU-CVE-2026-42254","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","status":"published","published":"2026-04-26T03:15:00Z","modified":"2026-10-17T12:58:55.185880094Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"}]}}