CVE-2026-123579 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS's DNSSEC validation does not tell apart NODATA responses from wildcard-expanded positive responses. An attacker can combine an NSEC3 record with a signed wildcard record to produce a bogus positive answer that validation accepts.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed Hickory DNS for DNSSEC-validating resolution are exposed, most likely a Rust resolver or DNS server built on hickory-net. Systems that only use an external resolver and never link the Hickory crates can skip it. unknown for whether hickory-proto alone is exploitable without hickory-net.
Not affected if external-resolver, no-hickory-dependency
Who cares dns-resolver, dnssec, hickory-dns, rust
cargo tree -i hickory-net or cargo tree -i hickory-proto0.26.0-beta.1 or any version below 0.26.2, and hickory-proto through 0.26.0-alpha.10.26.2 or later (fixed version stated in the sources for this CVE)DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.