[Pkg-rust-maintainers] Bug#1134954: rust-hickory-recursor: CVE-2026-42254

[Moritz Mühlenhoff]

Source: rust-hickory-recursor
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for rust-hickory-recursor.

CVE-2026-42254[0]:
| Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone
| poisoning because cached data is not directly associated with a
| query that triggered a response.

https://rustsec.org/advisories/RUSTSEC-2026-0106.html
https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-83hf-93m4-rgwq


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-42254
    https://www.cve.org/CVERecord?id=CVE-2026-42254

Please adjust the affected versions in the BTS as needed.