Read the docs
TI-2026-86745 Aliases CVE-2026-123603GHSA-g99j-j499-7pp4

Access control bypass in Hickory DNS via IPv4-mapped IPv6 addresses

Priority LOW 30CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Versions of hickory-proto and hickory-resolver from 0.26.0 before 0.26.2, hickory-server from 0.25.0-alpha.1 before 0.26.2, and hickory-recursor from 0.25.0-alpha.3 through 0.26.0-alpha.1 in Hickory DNS are affected. They fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules (CWE-284). An unauthenticated remote attacker can use IPv4-mapped addresses to evade answer filtering, query denied nameservers, or reach dual-stack hickory-server deployments from denied clients.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.

Why it matters now

EPSS 0.00166 5th percentileScored 2026-11-08
Fix Fixed hickory-dns (hickory-dns): 0.26.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
hickory-dnshickory-dns0.25.0-alpha.3 – 0.26.0-alpha.1—No fix listedCNA
hickory-dnshickory-dns0.26.0 to before 0.26.20.26.2Patch availableCNA
hickory-dnshickory-dns0.26.0 to before 0.26.20.26.2Patch availableCNA
hickory-dnshickory-dns0.25.0-alpha.1 to before 0.26.20.26.2Patch availableCNA
  • hickory-dns Vendorhickory-dns Affected 0.25.0-alpha.3 – 0.26.0-alpha.1 Fixed in — No fix listed CNA
  • hickory-dns Vendorhickory-dns Affected 0.26.0 to before 0.26.2 Fixed in 0.26.2 Patch available CNA
  • hickory-dns Vendorhickory-dns Affected 0.26.0 to before 0.26.2 Fixed in 0.26.2 Patch available CNA
  • hickory-dns Vendorhickory-dns Affected 0.25.0-alpha.1 to before 0.26.2 Fixed in 0.26.2 Patch available CNA

Remediation

Upgrade hickory-proto, hickory-resolver and hickory-server to version 0.26.2. The sources list no fixed version for hickory-recursor.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA hickory-dns (hickory-dns) Fixed in 0.26.2
  • Fix · CNA hickory-dns (hickory-dns) Fixed in 0.26.2
  • Fix · CNA hickory-dns (hickory-dns) Fixed in 0.26.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hickory-dns 0.26.2

    36 records Highest priority Priority LOW 36 LOW

    Other records, highest priority first

    • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referralsPriority LOW 38
    • TI-2026-86746 Unbounded retry loop in Hickory DNS resolver enables resource exhaustionPriority LOW 38
    • TI-2026-86730 Denial of service in Hickory DNS recursive resolver via empty poolPriority LOW 38
    Show all 36 records →

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-123603
  2. 2026-11-08 Alias added: GHSA-g99j-j499-7pp4
  3. 2026-11-09 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2025-18857 DNSSEC validation may accept broken authentication chains CVSS 4.0MEDIUM 5.7
  • TI-2026-63089 hickory-resolver before 0.26.2 DNSSEC Validation Bypass CVSS 4.0HIGH 8.7
  • TI-2026-86750 CPU exhaustion in Hickory DNS hickory-proto via BinEncoder name compression CVSS 4.0HIGH 8.7
  • TI-2026-86749 Hickory DNS NSEC3 validation loop enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referrals CVSS 4.0HIGH 8.7
  • TI-2026-86746 Unbounded retry loop in Hickory DNS resolver enables resource exhaustion CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences