{"id":"EUVD-2026-25687","enisaUuid":"a75c0c56-1b62-3e18-b874-f733cbe67866","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","datePublished":"Apr 26, 2026, 2:38:41 AM","dateUpdated":"Apr 27, 2026, 1:33:50 PM","baseScore":4.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","references":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-83hf-93m4-rgwq\n","aliases":"CVE-2026-42254\nGHSA-2hfw-w5cw-p4g7\n","assigner":"mitre","epss":0.16,"enisaIdProduct":[{"id":"4fc32e8c-2e27-3ba6-8d33-e1a77f35c7d6","product":{"name":"Hickory DNS","vendor":{"name":"Hickory Project"}},"product_version":"0.1 \u003c0.26"}],"enisaIdVendor":[{"id":"63fc2ae6-1e70-3529-8b18-509ae3b0d3ec","vendor":{"name":"Hickory Project"}}],"enisaIdVulnerability":[{"id":"444c0326-d18a-3c9f-b1ce-ff42bafec73d","vulnerability":{"id":"CVE-2026-42254","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","datePublished":"Apr 26, 2026, 2:38:41 AM","dateUpdated":"Apr 27, 2026, 1:33:50 PM","status":"PUBLISHED","baseScore":4.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","references":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-83hf-93m4-rgwq\n","enisa_id":"EUVD-2026-25687\n","assigner":"mitre","epss":0.16,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"3044fe34-6837-3d49-9ee7-1647399d3b9e","product":{"name":"Hickory DNS","vendor":{"name":"Hickory Project"}},"product_version":"0.1 \u003c0.26"}],"vulnerabilityVendor":[{"id":"d1be4c23-8efd-3a76-a2a6-b0fd7d29dcee","vendor":{"name":"Hickory Project"}}]}},{"id":"dea95efb-dda1-3e0f-9988-3263adc3fa2c","vulnerability":{"id":"GHSA-2hfw-w5cw-p4g7","description":"Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.","datePublished":"Apr 26, 2026, 3:30:25 AM","dateUpdated":"Apr 26, 2026, 3:30:25 AM","baseScore":0.0,"references":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-83hf-93m4-rgwq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42254\n","enisa_id":"EUVD-2026-25687\n","aliases":"GHSA-2hfw-w5cw-p4g7\nCVE-2026-42254\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}