Ghost Domain Name Attack in Hickory DNS Recursor and Resolver
CVE-2026-123602

8.2HIGH

Key Information:

Vendor

Hickory-dns

Status
Hickory-dns
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123602?

The Hickory DNS recursor and resolver are susceptible to attacks utilizing ghost domain names due to improper handling of cached NS RRsets. An attacker can exploit this flaw by continuously querying a zone's NS records, thus maintaining a stale RRset cache indefinitely. This may allow unauthorized name servers to respond to DNS queries for a domain even after the relevant delegation has been revoked, posing significant risks to domain security.

Affected Version(s)

hickory-dns 0 <= 0.26.0-alpha.1

hickory-dns 0.26.0-beta.1 < 0.26.2

hickory-dns 0.26.2

References

https://github.com/hickory-dns/hickory-dns/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/hickory-dns-recursor...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

qifan-sailboat
.