{"id":"CVE-2026-123583","aliases":[],"cve":{"records":[{"id":"CVE-2026-123583","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:55:55.661Z","published":"2026-11-08T01:38:16.884Z","modified":"2026-11-13T03:06:43.462Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:38:16.884Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T03:06:43.462Z"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vcjp-57rr-mpfw","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.25.0-through-0.25.2-missing-bailiwick-filtering-on-negative-responses","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-349","description":"Acceptance of Extraneous Untrusted Data With Trusted Data","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T03:06:33.846698Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responses","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to facilitate cache poisoning and more easily exploit other DNSSEC verification flaws.","score":6.3,"severity":"medium","published":"2026-11-08T01:38:16.884Z","modified":"2026-11-13T03:06:43.462Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.25.0","status":"affected","lessThanOrEqual":"0.25.2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-recursor","packageIdentity":{"ecosystem":"crates.io","name":"hickory-recursor"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123583"},{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.26.0","status":"affected","lessThan":"0.26.2","versionType":"semver"},{"version":"0.26.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-resolver","packageIdentity":{"ecosystem":"crates.io","name":"hickory-resolver"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123583"}],"remediation":[],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vcjp-57rr-mpfw","https://www.vulncheck.com/advisories/hickory-dns-0.25.0-through-0.25.2-missing-bailiwick-filtering-on-negative-responses"],"sources":[{"name":"CVE","id":"CVE-2026-123583","modified":"2026-11-13T03:06:43.462Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123583"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7}],"sourceAffected":[],"observedAt":"2026-11-13T06:57:25.104Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:55:30.737Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T02:30:34.595Z","attemptedAt":"2026-11-08T02:30:34.595Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T02:30:34.531Z","attemptedAt":"2026-11-08T02:30:34.531Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-08T02:30:34.906Z","attemptedAt":"2026-11-08T02:30:34.906Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T02:30:34.342Z","attemptedAt":"2026-11-08T02:30:34.342Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-123583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123583","modified":"2026-11-08T02:16:52.007","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T02:30:34.595Z"},{"source":"NVD","id":"CVE-2026-123583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123583","modified":"2026-11-08T02:16:52.007","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-08T02:30:34.595Z"}],"aiSummary":{"text":"Hickory DNS versions 0.25.0 through 0.25.2 and 0.26.0 before 0.26.2 are affected by a missing bailiwick filtering vulnerability on negative responses, allowing attackers to facilitate cache poisoning. Attackers must be able to supply crafted negative responses. The impact may include exploitation of other DNSSEC verification flaws.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T02:11:44.308Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123583"}]}}