CVE-2025-25188: hickory-dns
Vulnerability summary
CVE-2025-25188 is a medium (CVSS 5.7) vulnerability in hickory-dns. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 4Timeline
- 10-02-2025PublishedVulnerability first disclosed.
- 12-02-2025Last modifiedVulnerability information updated.
Description
Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to authenticate other records in the zone. There is a second variant of this vulnerability involving DS records, where an authenticated DS record covering one DNSKEY leads to trust in signatures made by an unrelated DNSKEY in the same zone. Versions 0.24.3 and 0.25.0-alpha.5 fix the issue.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · WolfiEcosystem advisory · calculated7.1HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- OSV · ChainguardEcosystem advisory · calculated7.1HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:PDiffers
- OSV · Crates.ioEcosystem advisory · calculated7.1HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- NVDNIST5.7MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
0.00 pp
From 0.28% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- linkerd2-proxy< 2.278.0-r1
- shadowsocks-rust< 1.22.0-r0
Wolfi2 products
- linkerd2-proxy< 2.278.0-r1
- shadowsocks-rust< 1.22.0-r0
Crates.Io1 product
- hickory-proto≥ 0.8.0, < 0.24.3
Debian1 product
- rust-hickory-proto< 0.24.3-1
Hickory-dns1 product
- hickory-dns≥ 0.8.0, < 0.24.3 | ≥ 0.25.0-alpha.1, < 0.25.0-alpha.5
Ubuntu1 product
- rust-hickory-protoAll versions (No fix recorded)
6 vendors · 8 products
References
8 links- github.com/hickory-dns/hickory-dns/security/advisories/GHSA-37wc-h8xc-5hc4X Refsource CONFIRMREPORTAdvisoryWEB
- github.com/hickory-dns/hickory-dns/commit/e118c6eec569f4340421f86ee0686714010c63e9X Refsource MISCFIXWEB
