CVE-2026-123578 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS libraries skip the check that a UDP DNS response's question matches the query when the question count is zero, and also skip the case-randomization check. An attacker who can inject spoofed UDP responses can use this to weaken defenses against DNS spoofing.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications written in Rust that use the Hickory DNS crates as a DNS client or resolver over UDP are exposed. Systems that do not use these crates, or that use a different DNS library, can skip it.
Not affected if not-using-hickory, tcp-only
Who cares dns, hickory-dns, rust
hickory-net crate at 0.26.0 up to but not including 0.26.2, or hickory-proto at 0.25.0 through 0.25.2, in Cargo.lock or cargo tree.hickory-net: move to or later.Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section matches the query when the response has an empty question section (QDCOUNT=0), and also skip the case-randomization check. Remote attackers able to inject spoofed UDP responses can send QDCOUNT=0 responses to bypass these checks, weakening defenses against DNS spoofing.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.26.2hickory-proto: the sources state the affected range 0.25.0 through 0.25.2; the fixed version is not stated in the given sources.