{"id":"CVE-2026-123581","kind":"vulnerability","aliases":["CVE-2026-123581"],"related":[],"title":"Hickory DNS: DNSSEC check accepts unrelated signed records as valid answers","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","summary":"Hickory DNS's DNSSEC validator accepts any valid signed record set in a response as a positive answer, without checking it matches the query. An attacker who can send responses can make missing records look like valid answers, so a resolver may trust the wrong data.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnssec","hickory-dns","package","rust"],"not_affected_if":["no-dnssec-validation","other-dns-library"],"how_to_check":"- Check the `hickory-proto` and `hickory-net` versions in your Cargo.lock or dependency tree; affected if `hickory-proto` is `0.26.0-alpha.1` or earlier, or `hickory-net` is `0.26.0-beta.1`\n- Confirm whether your service uses DNSSEC validation through Hickory (the resolver or validating client), since the flaw lies in the validator","fix":"- `hickory-proto` and `hickory-net` `0.26.2` (fixed version for both per the advisory)","status":"open","published_at":"2026-11-08T02:16:51+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:24:40+00:00","updated_at":"2026-11-08T02:24:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:24:40Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-proto` and `hickory-net` `0.26.2` (fixed version for both per the advisory)","reach":"network","title":"Hickory DNS: DNSSEC check accepts unrelated signed records as valid answers","impact":"medium","summary":"Hickory DNS's DNSSEC validator accepts any valid signed record set in a response as a positive answer, without checking it matches the query. An attacker who can send responses can make missing records look like valid answers, so a resolver may trust the wrong data.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dnssec","dns-resolver"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"forged DNS answers are accepted as valid, redirecting clients to wrong hosts","analyst_note":"Confirm the fixed version per product ranges and check the vendor advisory on github.com and the VulnCheck page for exploitation details.","how_to_check":"- Check the `hickory-proto` and `hickory-net` versions in your Cargo.lock or dependency tree; affected if `hickory-proto` is `0.26.0-alpha.1` or earlier, or `hickory-net` is `0.26.0-beta.1`\n- Confirm whether your service uses DNSSEC validation through Hickory (the resolver or validating client), since the flaw lies in the validator","plain_action":"","needs_analyst":true,"not_affected_if":["no-dnssec-validation","other-dns-library"],"who_is_affected":"Teams that build Rust software on the Hickory DNS crates and use DNSSEC validation, for example a resolver or a client that checks signed DNS answers. Services that do not use Hickory's DNSSEC validation, or that only use other DNS libraries, are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4346,"output_tokens":660,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123581':14A,17A '-2026':13A,16A '0.26.0':79C,85C '0.26.2':88C 'accept':5A,32B,95C 'alpha.1':80C 'answer':11A,44B,64B,101C,109C,138C 'appear':106C 'attack':52B,121C 'beta.1':86C 'check':4A,46B,112C 'contain':89C 'cve':12A,15A 'data':72B,144C 'dns':2A,19B,24B,28B,74C 'dns-resolv':18B 'dnssec':3A,21B,30B,91C 'flaw':93C 'hickori':1A,23B,27B,73C,76C,83C 'hickory-dn':22B 'hickory-net':82C 'hickory-proto':75C 'instead':139C 'lack':131C 'like':62B 'look':61B 'make':58B 'match':48B,132C 'may':68B 'miss':59B 'net':84C 'no-data':142C 'packag':25B 'posit':43B,100C,137C 'proto':77C 'queri':50B,120C 'record':8A,36B,60B,133C 'resolv':20B,67B 'respons':40B,56B,97C,117C,130C,145C 'rrset':105C,115C,127C 'rust':26B 'section':110C 'send':55B 'set':37B 'sign':7A,35B,124C 'suppli':123C 'trust':69B 'unrel':6A,126C 'valid':10A,31B,34B,63B,92C,104C,135C 'without':45B,111C 'wrong':71B","nicknames":[],"mitigations":[],"who_affected":"Teams that build Rust software on the Hickory DNS crates and use DNSSEC validation, for example a resolver or a client that checks signed DNS answers. Services that do not use Hickory's DNSSEC validation, or that only use other DNS libraries, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsresolver","dnssec","hickorydns","medium","package","rust"],"campaign_type":null,"search_a":"'-123581':14A,17A '-2026':13A,16A 'accept':5A 'answer':11A 'check':4A 'cve':12A,15A 'dns':2A 'dnssec':3A 'hickori':1A 'record':8A 'sign':7A 'unrel':6A 'valid':10A","search_b":"'accept':32B 'answer':44B,64B 'attack':52B 'check':46B 'data':72B 'dns':19B,24B,28B 'dns-resolv':18B 'dnssec':21B,30B 'hickori':23B,27B 'hickory-dn':22B 'like':62B 'look':61B 'make':58B 'match':48B 'may':68B 'miss':59B 'packag':25B 'posit':43B 'queri':50B 'record':36B,60B 'resolv':20B,67B 'respons':40B,56B 'rust':26B 'send':55B 'set':37B 'sign':35B 'trust':69B 'valid':31B,34B,63B 'without':45B 'wrong':71B","search_c":"'0.26.0':79C,85C '0.26.2':88C 'accept':95C 'alpha.1':80C 'answer':101C,109C,138C 'appear':106C 'attack':121C 'beta.1':86C 'check':112C 'contain':89C 'data':144C 'dns':74C 'dnssec':91C 'flaw':93C 'hickori':73C,76C,83C 'hickory-net':82C 'hickory-proto':75C 'instead':139C 'lack':131C 'match':132C 'net':84C 'no-data':142C 'posit':100C,137C 'proto':77C 'queri':120C 'record':133C 'respons':97C,117C,130C,145C 'rrset':105C,115C,127C 'section':110C 'sign':124C 'suppli':123C 'unrel':126C 'valid':92C,104C,135C 'without':111C","first_public_at":"2026-09-03T21:09:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123581","severity":null,"published_at":"2026-11-08T02:16:51+00:00","modified_at":"2026-11-08T02:16:51+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99313,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:09:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99314,"url":"https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-unrelated-rrset","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}