CVE-2026-42254: Hickory Project Hickory DNS

Medium severity, CVSS 4.0. EPSS: 0.3% chance of exploitation in the next 30 days.

Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.

Affected products

• Hickory Project Hickory DNS: from 0.1, before 0.26 (fixed in 0.26)

Published 2026-04-26. Last modified 2026-06-17.