Access Control Bypass in Hickory DNS Products by Hickory

CVE-2026-123603

What is CVE-2026-123603?

Recent findings indicate that several versions of Hickory DNS products, including hickory-proto, hickory-resolver, hickory-server, and hickory-recursor, fail to properly canonicalize IPv4-mapped IPv6 addresses. This oversight allows malicious actors to bypass access control mechanisms, leading to potential unauthorized access to denied server responses. As a consequence, attackers can exploit this vulnerability to send queries through restricted channels, potentially causing disruptions and compromising security protocols associated with server communications.

References