CVE-2026-123603: falha de média gravidade em hickory-dns
Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9
hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
hickory-dns · hickory-dnsCVEs relacionadas — hickory-dns
No mesmo produto, das mais perigosas para as menos.
CVE-2025-25188MEDIUMDNSSEC validation may accept broken authentication chainsEPSS 0.3%CVE-2026-123608HIGHHickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name CompressionEPSS —CVE-2026-123607HIGHHickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of ServiceEPSS —CVE-2026-123606HIGHHickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral AmplificationEPSS —CVE-2026-123605HIGHHickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's NameEPSS —CVE-2026-123604HIGHHickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry LoopEPSS —