{"id":"CVE-2026-123580","kind":"vulnerability","aliases":["CVE-2026-123580"],"related":[],"title":"Hickory DNS: NSEC3 zone check flaw lets forged DNSSEC nonexistence proofs pass","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.","summary":"Hickory DNS resolver libraries check only the hashed label of NSEC3 records during DNSSEC verification, without confirming the record belongs to the correct zone. An attacker can supply NSEC3 records from another zone to forge proofs that a name does not exist.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnssec","hickory-dns","package","rust"],"not_affected_if":["no-dnssec-validation","other-dns-software"],"how_to_check":"- Check the Hickory version in the lockfile or Cargo.lock for `hickory-net` and `hickory-proto`.\n- Look for `hickory-net` `0.26.0-beta.1` up to `0.26.2` (exclusive), or `hickory-proto` up to and including `0.26.0-alpha.1`.","fix":"- `hickory-net` `0.26.2`\n- `hickory-proto`: unknown (sources give only the affected range through `0.26.0-alpha.1`)","status":"open","published_at":"2026-11-08T02:16:51+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:22:51+00:00","updated_at":"2026-11-08T02:22:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:22:51Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net` `0.26.2`\n- `hickory-proto`: unknown (sources give only the affected range through `0.26.0-alpha.1`)","reach":"network","title":"Hickory DNS: NSEC3 zone check flaw lets forged DNSSEC nonexistence proofs pass","impact":"medium","summary":"Hickory DNS resolver libraries check only the hashed label of NSEC3 records during DNSSEC verification, without confirming the record belongs to the correct zone. An attacker can supply NSEC3 records from another zone to forge proofs that a name does not exist.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dnssec","dns-resolver"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"forged DNS nonexistence answers accepted as valid by the resolver","analyst_note":"Confirm the fixed version for hickory-proto, which the sources do not state, at the vendor advisory on github.com.","how_to_check":"- Check the Hickory version in the lockfile or Cargo.lock for `hickory-net` and `hickory-proto`.\n- Look for `hickory-net` `0.26.0-beta.1` up to `0.26.2` (exclusive), or `hickory-proto` up to and including `0.26.0-alpha.1`.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dnssec-validation","other-dns-software"],"who_is_affected":"Applications that embed the Hickory DNS Rust crates to perform DNSSEC-validating resolution are exposed. Systems using only DNS servers or resolvers built on other software, or without DNSSEC validation, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4334,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123580':15A,18A '-2026':14A,17A '0.26.0':75C,84C '0.26.2':78C 'alpha.1':85C 'anoth':59B,116C 'attack':53B,110C 'belong':47B,105C 'beta.1':76C 'check':5A,32B,88C 'compar':96C 'confirm':44B,102C 'correct':50B,108C 'cve':13A,16A 'dns':2A,20B,25B,29B,71C 'dns-resolv':19B 'dnssec':9A,22B,41B,94C,125C 'exist':69B 'flaw':6A 'forg':8A,62B,124C 'hash':35B,99C,121C 'hickori':1A,24B,28B,70C,73C,81C 'hickory-dn':23B 'hickory-net':72C 'hickory-proto':80C 'insuffici':87C 'label':36B,100C,122C 'let':7A 'librari':31B 'match':120C 'name':66B,92C 'net':74C 'nonexist':10A,126C 'nsec3':3A,38B,56B,90C,113C 'packag':26B 'pass':12A 'perform':86C 'proof':11A,63B,127C 'proto':82C 'record':39B,46B,57B,91C,104C,114C 'resolv':21B,30B 'rust':27B 'suppli':55B,112C 'verif':42B,95C 'without':43B,101C 'zone':4A,51B,60B,109C,117C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed the Hickory DNS Rust crates to perform DNSSEC-validating resolution are exposed. Systems using only DNS servers or resolvers built on other software, or without DNSSEC validation, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsresolver","dnssec","hickorydns","high","package","rust"],"campaign_type":null,"search_a":"'-123580':15A,18A '-2026':14A,17A 'check':5A 'cve':13A,16A 'dns':2A 'dnssec':9A 'flaw':6A 'forg':8A 'hickori':1A 'let':7A 'nonexist':10A 'nsec3':3A 'pass':12A 'proof':11A 'zone':4A","search_b":"'anoth':59B 'attack':53B 'belong':47B 'check':32B 'confirm':44B 'correct':50B 'dns':20B,25B,29B 'dns-resolv':19B 'dnssec':22B,41B 'exist':69B 'forg':62B 'hash':35B 'hickori':24B,28B 'hickory-dn':23B 'label':36B 'librari':31B 'name':66B 'nsec3':38B,56B 'packag':26B 'proof':63B 'record':39B,46B,57B 'resolv':21B,30B 'rust':27B 'suppli':55B 'verif':42B 'without':43B 'zone':51B,60B","search_c":"'0.26.0':75C,84C '0.26.2':78C 'alpha.1':85C 'anoth':116C 'attack':110C 'belong':105C 'beta.1':76C 'check':88C 'compar':96C 'confirm':102C 'correct':108C 'dns':71C 'dnssec':94C,125C 'forg':124C 'hash':99C,121C 'hickori':70C,73C,81C 'hickory-net':72C 'hickory-proto':80C 'insuffici':87C 'label':100C,122C 'match':120C 'name':92C 'net':74C 'nonexist':126C 'nsec3':90C,113C 'perform':86C 'proof':127C 'proto':82C 'record':91C,104C,114C 'suppli':112C 'verif':95C 'without':101C 'zone':109C,117C","first_public_at":"2026-09-03T20:55:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123580","severity":null,"published_at":"2026-11-08T02:16:51+00:00","modified_at":"2026-11-08T02:16:51+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99311,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-p2jv-r3m3-7wf4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T20:55:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99312,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-nonexistence-proof-forgery-via-nsec3","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}