Bug 2568716 (CVE-2026-123598)
| Summary: | CVE-2026-123598 hickory-recursor: hickory-resolver: hickory-net: Hickory DNS: Denial of service via extended caching of invalid DNSSEC responses | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability-draft | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Hickory DNS. The validating resolver improperly caches invalid Domain Name System Security Extensions (DNSSEC) responses using the attacker-supplied Time to Live (TTL) duration rather than an enforced short validation-failure duration. A remote attacker can exploit this flaw by spoofing an authoritative DNS response with an invalid signature and an extended TTL. This causes the resolver to retain the invalid record in its cache for an extended duration, resulting in a denial of service for legitimate domain resolution.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-08 02:01:55 UTC
|