Read the docs
TI-2025-18857 Aliases CVE-2025-25188GHSA-37wc-h8xc-5hc4

DNSSEC validation may accept broken authentication chains

Priority MEDIUM 59CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to authenticate other records in the zone. There is a second variant of this vulnerability involving DS records, where an authenticated DS record covering one DNSKEY leads to trust in signatures made by an unrelated DNSKEY in the same zone. Versions 0.24.3 and 0.25.0-alpha.5 fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00281 20th percentileScored 2026-11-07
Fix Fixed hickory-dns (hickory-dns): 0.24.3, 0.25.0-alpha.5hickory-proto (crates.io): 0.24.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hickory-dnshickory-dns0.8.0 to before 0.24.3; 0.25.0-alpha.1 to before 0.25.0-alpha.50.24.3, 0.25.0-alpha.5Patch availableCNA
—hickory-proto (crates.io)0.8.0 to before 0.24.30.24.3Patch availableGHSA-37wc-h8xc-5hc4
  • hickory-dns Vendorhickory-dns Affected 0.8.0 to before 0.24.3; 0.25.0-alpha.1 to before 0.25.0-alpha.5 Fixed in 0.24.3, 0.25.0-alpha.5 Patch available CNA
  • hickory-proto (crates.io) Vendor— Affected 0.8.0 to before 0.24.3 Fixed in 0.24.3 Patch available GHSA-37wc-h8xc-5hc4

Remediation

  • Fix · CNA hickory-dns (hickory-dns) Fixed in 0.24.3, 0.25.0-alpha.5
  • Fix · GHSA-37wc-h8xc-5hc4 hickory-proto (crates.io) Fixed in 0.24.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-25188
  2. 2026-10-03 Alias added: GHSA-37wc-h8xc-5hc4

References

Advisory 1

Other 3

  • TI-2026-86729 DNSSEC nonexistence forgery in Hickory DNS via wraparound NSEC CVSS 4.0HIGH 8.9
  • TI-2026-86750 CPU exhaustion in Hickory DNS hickory-proto via BinEncoder name compression CVSS 4.0HIGH 8.7
  • TI-2026-86749 Hickory DNS NSEC3 validation loop enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referrals CVSS 4.0HIGH 8.7
  • TI-2026-86747 DNSSEC validation bypass in Hickory DNS via RRSIG signer name CVSS 4.0HIGH 8.7
  • TI-2026-86746 Unbounded retry loop in Hickory DNS resolver enables resource exhaustion CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences