Out-of-Bailiwick Filtering Vulnerability in Hickory DNS Resolvers

CVE-2026-123583

What is CVE-2026-123583?

The Hickory DNS recursive resolver versions 0.25.0 through 0.25.2 and resolver version 0.26.0 before 0.26.2 allow attackers to exploit a lack of out-of-bailiwick filtering in negative DNS responses. This weakness enables malicious actors to inject out-of-bailiwick records, which can lead to cache poisoning attacks and may facilitate the exploitation of other DNSSEC verification vulnerabilities. Organizations using affected versions should take immediate action to mitigate this risk.

References