CVE-2026-42254 Other in Hickory DNS
Attackers can poison DNS cache entries across zones, leading to incorrect resolution data for users of the Hickory DNS recursor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42254?
CVE-2026-42254 is a medium-severity vulnerability in Hickory DNS, published on 26 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.
Weakness: CWE-706
Which versions are affected by CVE-2026-42254?
4 open source packages ship an affected version, including hickory-recursor.
| Package | Affected | Fixed in |
|---|---|---|
hickory-recursor crates.io | All versions | None |
hickory-recursor crates.io | All versions | None |
hickory-recursor crates.io | From 0.24.0 | 0.26.0 |
hickory-recursor crates.io | From 0.24.0 | 0.26.0 |
How do I fix CVE-2026-42254?
Upgrade hickory-recursor to 0.26.0 or later.
Is CVE-2026-42254 being exploited?
There is no known exploitation of CVE-2026-42254 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-42254, GHSA-2hfw-w5cw-p4g7, GHSA-83hf-93m4-rgwq, UBUNTU-CVE-2026-42254.