CVE-2026-123603

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.

Referanslar

• https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4jwp-xjwm-333g
• https://www.vulncheck.com/advisories/hickory-dns-missing-ipv4-mapped-ipv6-canonicalization-access-control-bypass