CVE-2026-123580 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS resolver libraries check only the hashed label of NSEC3 records during DNSSEC verification, without confirming the record belongs to the correct zone. An attacker can supply NSEC3 records from another zone to forge proofs that a name does not exist.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed the Hickory DNS Rust crates to perform DNSSEC-validating resolution are exposed. Systems using only DNS servers or resolvers built on other software, or without DNSSEC validation, can skip it.
Not affected if no-dnssec-validation, other-dns-software
Who cares dns-resolver, dnssec, hickory-dns, rust
hickory-net and hickory-proto.hickory-net 0.26.0-beta.1 up to 0.26.2 (exclusive), or hickory-proto up to and including 0.26.0-alpha.1.hickory-net Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.26.2hickory-proto: unknown (sources give only the affected range through 0.26.0-alpha.1)