---
id: "CVE-2026-123581"
page: "https://infrastack.ai/live/CVE-2026-123581"
kind: "vulnerability"
aliases: ["CVE-2026-123581"]
title: "Hickory DNS: DNSSEC check accepts unrelated signed records as valid answers"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns-resolver", "dnssec", "hickory-dns", "package", "rust"]
not_affected_if: ["no-dnssec-validation", "other-dns-library"]
published_at: "2026-11-08T02:16:51+00:00"
first_seen_at: "2026-11-08T02:21:12+00:00"
updated_at: "2026-11-08T02:24:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123581", "first_seen_at": "2026-11-08T02:21:12+00:00"}]
exploit_sources: []
---

# Hickory DNS: DNSSEC check accepts unrelated signed records as valid answers

Link for people: https://infrastack.ai/live/CVE-2026-123581 (this .md is for agents)

Hickory DNS's DNSSEC validator accepts any valid signed record set in a response as a positive answer, without checking it matches the query. An attacker who can send responses can make missing records look like valid answers, so a resolver may trust the wrong data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the `hickory-proto` and `hickory-net` versions in your Cargo.lock or dependency tree; affected if `hickory-proto` is `0.26.0-alpha.1` or earlier, or `hickory-net` is `0.26.0-beta.1`
- Confirm whether your service uses DNSSEC validation through Hickory (the resolver or validating client), since the flaw lies in the validator

## Fix

- `hickory-proto` and `hickory-net` `0.26.2` (fixed version for both per the advisory)

## Timeline

- 2026-11-08T02:21:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123581

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-unrelated-rrset

## From the sources

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_