Hickory DNS CVE-2026-123603

Not a default-config remote flaw despite PR:N. For hickory-server, exploitation requires library code (not the hickory-dns binary) using Server::with_access() AND register_socket() with IPv6 sockets that omit set_only_v6(true), so a dual-stack socket accepts IPv4-mapped clients; a denied client can then connect via ::ffff: form. For hickory-resolver, ResolverOpts must set deny_answers (or, with the non-default recursor feature, RecursorOptions with deny_answers/deny_server). For hickory-proto, the non-default access-control feature relying on AccessControlSet must be in use. For the now-defunct hickory-recursor crate, RecursorOptions with deny_answers/deny_server. Limiting factors: the vulnerable features are opt-in and non-default, an administrator must have configured a deny/allow filter for there to be anything to bypass, and the hickory-dns binary is explicitly unaffected - materially narrowing real-world exposure.

This is a genuine access-control-bypass flaw but a moderate-priority one, not a drop-everything emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes unauthenticated, low-complexity network reach, yet the vulnerable-system impacts are capped at VC:L/VI:L/VA:N, yielding a 6.9 (Medium) - the issue weakens a security control rather than directly disclosing sensitive data or granting code execution. The vuln.today decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score provided, so widespread or active exploitation is not indicated. No public exploit identified at time of analysis - only vendor/advisory references (GHSA, VulnCheck) exist, not working exploit code. The most important nuance the raw PR:N score hides: exploitation is strongly gated by non-default configuration - the affected paths require opt-in features (access-control, recursor) or explicit filter settings (deny_answers, deny_server, AccessControlSet), and the hickory-dns binary itself is explicitly NOT affected; only library integrations are. So the PR:N network-vector score overstates real-world exposure for most deployments. EPSS is not supplied, so probability of exploitation cannot be quantified from this data.

An attacker whose real IPv4 address is on a hickory-server library deployment's client deny list connects over a dual-stack IPv6 socket using the IPv4-mapped form (::ffff:a.b.c.d); because the address is not canonicalized before the allow/deny check, the request is accepted despite the block. In the resolver/recursor case, a malicious nameserver or response uses IPv4-mapped addresses so that answers which should be stripped by deny_answers pass through, or queries reach a nameserver that deny_server should have blocked. No public exploit code is identified at time of analysis.