AIKIDO-2026-511238
hickory-resolver is vulnerable to DNS Cache Poisoning
50
Medium Risk
This Affects:
hickory-resolverTL;DR
The recursive resolver applies out-of-bailiwick filtering to positive responses but not to negative responses. Records outside the queried zone's bailiwick in a negative response are therefore accepted and cached. This weakens a defense against cache poisoning and can make other DNSSEC validation weaknesses easier to exploit. The fix applies bailiwick filtering to negative responses as well.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the recursive resolver
Background info
hickory-resolver is vulnerable to DNS Cache Poisoning in versions 0.26.0 - 0.26.1.
How to fix this
Upgrade the hickory-resolver library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.