{"id":"CVE-2026-123578","kind":"vulnerability","aliases":["CVE-2026-123578"],"related":[],"title":"Hickory DNS: UDP responses with empty question section skip spoofing checks","description":"Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section matches the query when the response has an empty question section (QDCOUNT=0), and also skip the case-randomization check. Remote attackers able to inject spoofed UDP responses can send QDCOUNT=0 responses to bypass these checks, weakening defenses against DNS spoofing.","summary":"Hickory DNS libraries skip the check that a UDP DNS response's question matches the query when the question count is zero, and also skip the case-randomization check. An attacker who can inject spoofed UDP responses can use this to weaken defenses against DNS spoofing.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","hickory-dns","package","rust"],"not_affected_if":["not-using-hickory","tcp-only"],"how_to_check":"- Look for the `hickory-net` crate at `0.26.0` up to but not including `0.26.2`, or `hickory-proto` at `0.25.0` through `0.25.2`, in `Cargo.lock` or `cargo tree`.\n- Check whether the application uses Hickory DNS as a DNS client or resolver over UDP.","fix":"- `hickory-net`: move to `0.26.2` or later.\n- `hickory-proto`: the sources state the affected range `0.25.0` through `0.25.2`; the fixed version is not stated in the given sources.","status":"open","published_at":"2026-11-08T02:16:51+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:25:05+00:00","updated_at":"2026-11-08T02:25:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:25:05Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net`: move to `0.26.2` or later.\n- `hickory-proto`: the sources state the affected range `0.25.0` through `0.25.2`; the fixed version is not stated in the given sources.","reach":"network","title":"Hickory DNS: UDP responses with empty question section skip spoofing checks","impact":"low","summary":"Hickory DNS libraries skip the check that a UDP DNS response's question matches the query when the question count is zero, and also skip the case-randomization check. An attacker who can inject spoofed UDP responses can use this to weaken defenses against DNS spoofing.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dns"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"DNS spoofing defenses are weakened for affected resolver clients","analyst_note":"","how_to_check":"- Look for the `hickory-net` crate at `0.26.0` up to but not including `0.26.2`, or `hickory-proto` at `0.25.0` through `0.25.2`, in `Cargo.lock` or `cargo tree`.\n- Check whether the application uses Hickory DNS as a DNS client or resolver over UDP.","plain_action":"","needs_analyst":false,"not_affected_if":["not-using-hickory","tcp-only"],"who_is_affected":"Applications written in Rust that use the Hickory DNS crates as a DNS client or resolver over UDP are exposed. Systems that do not use these crates, or that use a different DNS library, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4340,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123578':14A,17A '-2026':13A,16A '0':108C,128C '0.25.0':83C '0.25.2':85C '0.26.0':76C '0.26.2':78C 'abl':119C 'also':47B,110C 'attack':55B,118C 'bypass':131C 'case':51B,114C 'case-random':50B,113C 'check':11A,29B,53B,88C,116C,133C 'count':43B 'cve':12A,15A 'defens':67B,135C 'dns':2A,18B,21B,25B,33B,69B,72C,137C 'empti':6A,104C 'hickori':1A,20B,24B,71C,74C,81C 'hickory-dn':19B 'hickory-net':73C 'hickory-proto':80C 'inject':58B,121C 'librari':26B 'match':37B,96C 'net':75C 'packag':22B 'proto':82C 'qdcount':107C,127C 'queri':39B,98C 'question':7A,36B,42B,94C,105C 'random':52B,115C 'remot':117C 'respons':4A,34B,61B,92C,101C,124C,129C 'rust':23B 'section':8A,95C,106C 'send':126C 'skip':9A,27B,48B,86C,111C 'spoof':10A,59B,70B,122C,138C 'udp':3A,32B,60B,91C,123C 'use':63B 'weaken':66B,134C 'zero':45B","nicknames":[],"mitigations":[],"who_affected":"Applications written in Rust that use the Hickory DNS crates as a DNS client or resolver over UDP are exposed. Systems that do not use these crates, or that use a different DNS library, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","hickorydns","medium","package","rust"],"campaign_type":null,"search_a":"'-123578':14A,17A '-2026':13A,16A 'check':11A 'cve':12A,15A 'dns':2A 'empti':6A 'hickori':1A 'question':7A 'respons':4A 'section':8A 'skip':9A 'spoof':10A 'udp':3A","search_b":"'also':47B 'attack':55B 'case':51B 'case-random':50B 'check':29B,53B 'count':43B 'defens':67B 'dns':18B,21B,25B,33B,69B 'hickori':20B,24B 'hickory-dn':19B 'inject':58B 'librari':26B 'match':37B 'packag':22B 'queri':39B 'question':36B,42B 'random':52B 'respons':34B,61B 'rust':23B 'skip':27B,48B 'spoof':59B,70B 'udp':32B,60B 'use':63B 'weaken':66B 'zero':45B","search_c":"'0':108C,128C '0.25.0':83C '0.25.2':85C '0.26.0':76C '0.26.2':78C 'abl':119C 'also':110C 'attack':118C 'bypass':131C 'case':114C 'case-random':113C 'check':88C,116C,133C 'defens':135C 'dns':72C,137C 'empti':104C 'hickori':71C,74C,81C 'hickory-net':73C 'hickory-proto':80C 'inject':121C 'match':96C 'net':75C 'proto':82C 'qdcount':107C,127C 'queri':98C 'question':94C,105C 'random':115C 'remot':117C 'respons':92C,101C,124C,129C 'section':95C,106C 'send':126C 'skip':86C,111C 'spoof':122C,138C 'udp':91C,123C 'weaken':134C","first_public_at":"2026-09-03T21:41:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123578","severity":null,"published_at":"2026-11-08T02:16:51+00:00","modified_at":"2026-11-08T02:16:51+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99307,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3w89-7rx5-hpwx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:41:27+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99308,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-before-0.26.2-response-validation-bypass-via-qdcount-0","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}