Threats affecting pkg:cargo/hickory-recursor

A vulnerability in Hickory DNS validating recursor versions 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 allows caching of DNSSEC-bogus answers with an attacker-controlled TTL up to 24 hours. This occurs because the recursor uses the untrusted TTL from the attacker-supplied record instead of a short validation-failure TTL. An attacker can exploit this by spoofing an authoritative response with an invalid signature and a long TTL, causing the bogus result to be cached for up to 24 hours.

A vulnerability in the recursive resolver of Hickory DNS affects all versions of the hickory-recursor crate and hickory-resolver versions before 0.26.2. The resolver caches an empty connection pool when it encounters a referral without glue records and all IP address queries for the name servers fail. An attacker capable of spoofing DNS responses can exploit this to cause lookup failures for the affected zone until the cache entry expires or is evicted.

A vulnerability in hickory-recursor allows it to repeatedly query cyclic glueless sibling delegations between two zones, causing excessive upstream queries. This occurs because the recursor does not stop resolving when it encounters a zone it is already processing. The issue affects versions starting from 0.25.0-alpha.3. The recursor code has moved to hickory-resolver with an opt-in feature, and a fix is available in hickory-resolver 0.26.2. No fixed release exists for hickory-recursor itself.

A vulnerability in hickory-recursor versions from 0.25.0-alpha.3 onward allows an attacker controlling a DNS zone to cause the recursor to resolve every glueless name server in a referral without limits. This can lead to a large volume of queries being sent to victim servers (NXNSAttack pattern) or exhaustion of the recursor's resources. The recursor functionality moved to hickory-resolver starting with version 0.26.0-beta.1, and a fix is available in hickory-resolver 0.26.2. No hickory-recursor release contains a fix, so users should upgrade to hickory-resolver 0.26.2 or later with the recursor feature enabled.

The Hickory DNS project's experimental recursor crate has a vulnerability in its record cache that allows cross-zone DNS cache poisoning. The cache stores DNS records keyed by each record's own name and type rather than by the original query, enabling an attacker controlling a parent zone to inject NS records for sibling zones. This causes recursive queries for the sibling zone to be redirected to the attacker's nameserver. The issue is fixed in hickory-resolver 0.26.0 with a change to response-level caching keyed by the query. Users of affected versions should upgrade to 0.26.0 or later.