EUVD-2026-119361
GHSA-4vjf-x5x5-8f5h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOperate name servers for target zone
-
ExploitRepeatedly query zone NS records
-
ExecutionPin stale apex NS RRset in cache
-
ImpactServe DNS responses after delegation revoked
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Operation on resource after expiration or release
|
| Exploitation Conditions | Exploitation requires the recursor code path to be active: the hickory-recursor crate (all versions) or hickory-resolver 0.26.0-beta.1 through 0.26.1 with the optional 'recursor' feature enabled - resolvers without the recursor feature are not affected. The attacker must control (or have controlled) the zone's delegated name servers and must repeatedly send '<zone>. IN NS' queries to the recursor to keep the apex NS RRset cached. The attack only produces a security impact once the parent zone revokes or changes the delegation (AT:P captures this attacker-uncontrolled precondition); until revocation there is no divergence from correct resolution. No authentication or user interaction is required (PR:N/UI:N). |
| Impact | This is a genuine integrity flaw but a moderate, not top-tier, operational priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H) and the vuln.today 'this_week' label agree: network-reachable, unauthenticated, integrity-only impact (VI:H), with an attack requirement (AT:P) that reflects the real-world precondition that the parent zone must revoke or change its delegation for the attack to have effect. KEV status is not provided, so there is no confirmed active exploitation. No EPSS score is provided, so exploitation probability cannot be weighed - this is a missing signal, not a low one. No working exploit is referenced (only vendor and VulnCheck advisories), so this is no public exploit identified at time of analysis. The impact is bounded to integrity: an attacker who previously held a delegation can keep controlling DNS responses for a zone after revocation (a 'ghost domain'), which has no confidentiality or availability effect per the vector. Note a data conflict: the input tag 'Information Disclosure' contradicts the CVSS vector, which sets VC:N and VI:H - this is an integrity/control issue, not disclosure. Net: real and worth patching this week, but the requirement for a prior-then-revoked delegation and the niche footprint of the affected product keep it below emergency priority. |
| Exploit ScenarioDerived | An attacker who operates (or operated) the name servers delegated for a zone continuously sends '<zone>. IN NS' queries to a Hickory DNS recursor, pinning the child-side apex NS RRset in cache indefinitely. When the parent registry later revokes or changes that delegation, the recursor keeps using the stale cached name servers for iterative resolution, so the attacker's servers continue answering for the zone past revocation. No confirmed working exploit code was identified; vendor and VulnCheck advisories describe the mechanism. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 08, 2026
The Hickory DNS recursor keeps using apex NS records it learned from the child side of a delegation even after the parent zone has revoked or changed that delegation, so stale name servers can keep answering for a zone. Affected code is the hickory-recursor crate in all versions and hickory-resolver 0.26.0-beta.1 through 0.26.1 when the optional 'recursor' feature is enabled; resolvers built without that feature are not affected. An unauthenticated remote attacker who controls (or once controlled) a zone's delegated name servers can repeatedly send '<zone>. IN NS' queries to keep the RRset cached indefinitely, and once the parent revokes the referral the recursor still trusts the old servers, giving them control over resolution of the zone. No public exploit code has been identified at time of analysis, and the flaw is scored 8.2 under CVSS 4.0 (with a 3.1 assessment of AC:H, I:H) because the integrity impact only materializes after a delegation change the attacker does not control.
RemediationAI
Upgrade hickory-resolver to 0.26.2 or later; that release contains the fix for the recursor feature, and deployments built without the 'recursor' feature are unaffected and need no action. For hickory-recursor, no fixed version exists at time of analysis (advisory states 'not yet patched'), so consumers of that crate should migrate to hickory-resolver 0.26.2+ with the recursor feature enabled, or stop building the recursor functionality entirely until a patched hickory-recursor release appears. Confirmation and detail are in the vendor advisory at https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2hxp-x833-73f7 and the VulnCheck advisory at https://www.vulncheck.com/advisories/hickory-dns-recursor-ghost-domain-attack-via-child-side-ns-rrset-caching. No documented configuration workaround for the caching behavior itself is provided in the available sources; the only supported posture is to not run the affected recursor code until a patched version is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a modern instance of the 'ghost domain names' class previously documented as CVE-2012-1033 and CVE-2022-30698, and maps to CWE-672 (operation on a resource after expiration or release): a cached delegation-side resource outlives the authority that granted it. In Hickory's recursive resolver, a client-issued '<zone>. IN NS' query causes the zone's apex NS RRset to be fetched from the zone's own name servers and stored in the response cache; that cached copy is then reused when the recursor performs iterative resolution for the same zone. Because repeated queries refresh the cache entry, the attacker can hold the stale NS RRset in cache indefinitely. The parent zone's delegation is the authoritative source of which name servers serve a child zone, but the recursor is preferring the child-side copy, so a delegation removal or change at the parent is never honored. The independent assessment notes the trigger requires the recursor code path to be active and an attacker with control of the zone's delegated name servers plus sustained NS querying; the CVSS 4.0 vector's AT:P reflects that the integrity impact only appears after a parent-side revocation that the attacker does not control, and until that revocation occurs there is no divergence from correct resolution. No authentication or user interaction is needed (PR:N/UI:N in both the 4.0 and 3.1 vectors).
Know when Hickory Dns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because impact depends on a parent-revocation event the attacker does not control; integrity-only (I:H), no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.
Technical POC Analysis
Bug class: CWE-672, operation on a resource after expiry or revocation (the requester-supplied CWE; the supplied advisory itself assigns no CWE and states "No known CVE", so the CVE ID and CVSS 8.2 c…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-123602 is a high-severity (CVSS 8.2) vulnerability in the Hickory DNS recursor component (hickory-recursor crate and hickory-resolver with the recursor feature) that allows stale, potentially attacker-controlled name servers to continue resolving a zone after the parent has revoked the delegation. This undermines the integrity of DNS resolution for affected zones and could enable traffic redirection or service disruption. Leadership should care because any product or internal service relying on Hickory DNS with the recursor feature may be exposed to domain hijacking or cache poisoning, eroding trust in network communications.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable the recursor feature if not required; restrict network access to the recursor; deploy DNS monitoring to detect unusual NS query patterns; use DNSSEC validation where possible; consider replacing Hickory DNS with an alternative resolver for exposed services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Hickory DNS Multiple Security Flaws
View all 36More in Hickory Dns
View allMalformed TSIG records can crash Hickory DNS 0.26.0 through 0.26.1 builds compiled with overflow checks enabled, causing
Remote, unauthenticated memory-amplification denial of service affects Hickory DNS (the hickory-proto crate) versions 0.
Exploit-DB