EUVD-2026-25687Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Lifecycle Timeline
6DescriptionCVE.org
Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.
AnalysisAI
Hickory DNS recursor versions 0.1 through 0.25.2 allow cross-zone DNS poisoning attacks due to cached DNS responses not being directly associated with the query that triggered them, enabling attackers to inject malicious DNS records across zone boundaries and potentially redirect traffic to attacker-controlled servers without user interaction or authentication.
Technical ContextAI
Hickory DNS is a DNS resolver library written in Rust. The vulnerability stems from improper cache management in the recursor component (CWE-706: Use of Incorrectly-Resolved Name). DNS caching typically requires strong association between cached records and the specific query context (including query name, type, and class) to prevent poisoning. When this association is weak or absent, an attacker can craft DNS responses that cause the resolver to cache records outside their intended zone of authority. This violates DNS security principles and allows attackers to poison cached data across zone boundaries, affecting all downstream clients that rely on the recursor.
RemediationAI
Upgrade Hickory DNS to a version later than 0.25.2; specific patched version not confirmed from provided data, so verify latest release at https://github.com/hickory-dns/hickory-dns/releases. As an interim compensating control, restrict DNS recursor access to trusted internal networks only by implementing network ACLs limiting queries to authorized subnets, reducing attack surface from untrusted external sources. Alternatively, use DNSSEC validation if supported by the deployment to cryptographically verify DNS responses, mitigating the risk of accepted poisoned records - note this introduces computational overhead. Disable recursive queries if the recursor is only meant to serve authoritative responses, further limiting attack scope. Monitor DNS query logs and cache hit rates for anomalies indicating poisoning attempts (e.g., unexpected cross-zone responses).
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today