CVE-2026-42254 — Hickory DNS hickory-recursor 0.1 through 0.25.2 allows

title: CVE-2026-42254 - Hickory DNS Cross-Zone Poisoning Attempt
id: scw-2026-04-26-ai-1
status: experimental
level: high
description: |
  Detects potential cross-zone DNS poisoning attempts targeting Hickory DNS versions 0.1 through 0.25.2. This rule looks for DNS queries that appear to be attempting to poison cache by resolving external domains and potentially injecting malicious data into the DNS cache, exploiting the vulnerability where cached data is not directly associated with the triggering query.
author: SCW Feed Engine (AI-generated)
date: 2026-04-26
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42254/
tags:
  - attack.command_and_control
  - attack.t1071.004
logsource:
    category: dns
detection:
  selection:
      dst_domain|contains:
          - "."
      dst_port:
          - 53
      query|contains:
          - "."
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse