
CVE-2026-42254 Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response. https://www.cve.org/CVERecord?id=CVE-2026-42254
Post summary
The text discloses CVE‑2026‑42254, a cross‑zone DNS cache poisoning flaw in Hickory DNS recursor 0.1‑0.25.2, caused by a missing link between cached data and query context.


