CVE-2026-123581 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS's DNSSEC validator accepts any valid signed record set in a response as a positive answer, without checking it matches the query. An attacker who can send responses can make missing records look like valid answers, so a resolver may trust the wrong data.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that build Rust software on the Hickory DNS crates and use DNSSEC validation, for example a resolver or a client that checks signed DNS answers. Services that do not use Hickory's DNSSEC validation, or that only use other DNS libraries, are not exposed.
Not affected if no-dnssec-validation, other-dns-library
Who cares dns-resolver, dnssec, hickory-dns, rust
hickory-proto and hickory-net versions in your Cargo.lock or dependency tree; affected if hickory-proto is 0.26.0-alpha.1 or earlier, or hickory-net is 0.26.0-beta.1hickory-proto and (fixed version for both per the advisory)Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hickory-net0.26.2