CVE-2026-123602 in hickory-recursor
Summary
by MITRE • 11/08/2026
The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/08/2026
The vulnerability identified in Hickory DNS recursor versions prior to 0.26.2 represents a significant flaw in how iterative resolution and caching mechanisms interact with domain name system delegations. This issue specifically affects the recursor component, which is responsible for resolving queries on behalf of clients by traversing the hierarchical structure of the Domain Name System from root servers down to authoritative nameservers. The core technical deficiency lies in the handling of child-side apex NS RRsets during iterative resolution processes. When Hickory DNS performs an iterative query, it retrieves and caches the name server records associated with a specific zone delegation. However, the implementation fails to adequately validate whether these cached records remain current or if they have been superseded by newer delegations issued by parent zones. This oversight allows stale resource record sets to persist in memory indefinitely under certain conditions, creating an opportunity for what is known as ghost domain name attacks.
The operational mechanism of this vulnerability relies on the attacker's ability to manipulate caching behavior through repeated queries. By continuously querying a zone’s NS records, an adversary can trigger the recursor to retain specific cached entries that should have been invalidated or updated due to changes in delegation authority at higher levels of the DNS hierarchy. In standard DNS operations, when a parent zone revokes its delegation to certain name servers and assigns it to new ones, all recursive resolvers are expected to update their cache accordingly. However, because Hickory DNS reuses child-side apex NS RRsets without sufficient verification against current parental delegations, it continues to direct queries toward the old, revoked nameservers. These ghost domains effectively remain active in the resolver's view of the network topology even though they no longer hold legitimate authority over the zone.
The impact of this vulnerability is severe for both service providers and end-users relying on Hickory DNS recursors. Attackers who control or compromise the stale name servers can intercept, modify, or block traffic intended for the legitimate domain owners. This capability facilitates a range of malicious activities including man-in-the-middle attacks where sensitive data such as login credentials or financial information is intercepted during transmission. It also enables phishing campaigns by serving fraudulent content that mimics legitimate websites hosted under the affected domains. Furthermore, this flaw undermines the integrity and reliability of DNS resolution services, potentially leading to widespread outages if large numbers of resolvers are compromised simultaneously through automated exploitation scripts targeting multiple zones.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation as it involves failing to properly validate cached data against authoritative sources before reuse. It also maps closely to MITRE ATT&CK technique T1598 Phishing for Information which describes how attackers exploit trust relationships in infrastructure to gain unauthorized access or manipulate communications. The specific behavior of keeping stale records active corresponds to aspects of cache poisoning where an attacker manipulates the state of a DNS resolver to serve incorrect information. Understanding these mappings helps security teams contextualize the risk within broader threat landscapes and prioritize remediation efforts accordingly.
Mitigation strategies must focus on updating software components immediately to version 0.26.2 or later where this logic has been corrected. Organizations running Hickory DNS recursors should verify their deployment configurations ensure that automatic updates are enabled for critical infrastructure services. Additionally, implementing strict monitoring of DNS query patterns can help detect anomalies indicative of ghost domain attacks such as unusually high frequencies of NS record queries targeting specific zones. Security teams should also consider deploying additional layers of defense such as DNSSEC validation to cryptographically verify the authenticity of responses received from authoritative servers regardless of cached state. Regular audits of caching policies and periodic reviews of resolver configurations against current best practices will further reduce exposure to similar vulnerabilities in future updates or related software components within the ecosystem.