---
id: "CVE-2026-123580"
page: "https://infrastack.ai/live/CVE-2026-123580"
kind: "vulnerability"
aliases: ["CVE-2026-123580"]
title: "Hickory DNS: NSEC3 zone check flaw lets forged DNSSEC nonexistence proofs pass"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns-resolver", "dnssec", "hickory-dns", "package", "rust"]
not_affected_if: ["no-dnssec-validation", "other-dns-software"]
published_at: "2026-11-08T02:16:51+00:00"
first_seen_at: "2026-11-08T02:21:12+00:00"
updated_at: "2026-11-08T02:22:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123580", "first_seen_at": "2026-11-08T02:21:12+00:00"}]
exploit_sources: []
---

# Hickory DNS: NSEC3 zone check flaw lets forged DNSSEC nonexistence proofs pass

Link for people: https://infrastack.ai/live/CVE-2026-123580 (this .md is for agents)

Hickory DNS resolver libraries check only the hashed label of NSEC3 records during DNSSEC verification, without confirming the record belongs to the correct zone. An attacker can supply NSEC3 records from another zone to forge proofs that a name does not exist.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Hickory version in the lockfile or Cargo.lock for `hickory-net` and `hickory-proto`.
- Look for `hickory-net` `0.26.0-beta.1` up to `0.26.2` (exclusive), or `hickory-proto` up to and including `0.26.0-alpha.1`.

## Fix

- `hickory-net` `0.26.2`
- `hickory-proto`: unknown (sources give only the affected range through `0.26.0-alpha.1`)

## Timeline

- 2026-11-08T02:21:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123580

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-p2jv-r3m3-7wf4
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-nonexistence-proof-forgery-via-nsec3

## From the sources

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_