Hickory DNS Recursor CVE-2026-42254

The vulnerability requires the Hickory DNS recursor to accept and cache DNS responses where cached data is decoupled from the query that triggered the response. This occurs in default caching configurations of affected versions. Exploitation is limited by AC:H (high attack complexity), implying the attacker must satisfy specific timing, network, or query pattern conditions to trigger successful cache poisoning. No authentication is required (PR:N) and the attack is remotely feasible (AV:N) against any network-accessible recursor. The vulnerability is specific to recursor behavior; authoritative-only DNS deployments are unaffected. Client-side protections such as DNSSEC validation can mitigate acceptance of poisoned responses.

CVSS 4.0 with network vector (AV:N), high complexity (AC:H), and integrity impact (I:L) indicates moderate real-world risk with concrete exploitation barriers. The high complexity requirement suggests successful exploitation demands specific conditions or timing. EPSS score not provided, limiting probability assessment. No KEV status or public exploit data provided, meaning active exploitation is not confirmed. The attack scope change (S:C) indicates potential for impact beyond the vulnerable component, affecting downstream DNS clients. The integrity-only impact (no confidentiality or availability) is consistent with DNS poisoning (data modification, not disclosure). CVSS and description alignment is strong: network-accessible DNS service vulnerable to poisoning but requiring favorable conditions (AC:H). Risk prioritization should focus on recursor deployments in critical DNS infrastructure; standard caching resolvers may have lower practical impact depending on query patterns and cache timeouts.

An attacker sends a specially crafted DNS response to a recursive resolver running Hickory DNS, causing the resolver to cache a record (e.g., A record for target.com pointing to attacker IP) in a way that is not properly associated with the original query context. Subsequent legitimate clients querying the resolver receive the poisoned record, redirecting them to the attacker's server. This succeeds because AC:H suggests the attacker must time the response carefully or exploit a specific caching race condition, but requires no authentication or user interaction.