CVE-2026-123582 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS's validating resolver and forwarder do not check whether the SOA record in NXDOMAIN or NODATA answers passed DNSSEC validation. An attacker who can supply forged DNS responses can get a forged SOA returned to clients with the AD (authenticated data) bit set, so clients that trust the server's validation are misled.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a Hickory DNS server (hickory-server 0.25.0 up to 0.26.2) as a validating recursive resolver or forwarder, where clients rely on its DNSSEC validation. Deployments that only use Hickory for authoritative answers or that do not rely on the AD bit are less exposed. The sources do not say more about configuration requirements.
Not affected if no-dnssec-reliance, no-validating-resolver, version-0.26.2-or-later
Who cares dns, dnssec, hickory-dns, hickory-server, rust
hickory-server version in your Cargo.lock or dependency tree; affected versions are 0.25.0 before 0.26.2.hickory-server 0.26.2The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the SOA record passed DNSSEC validation when assembling NXDOMAIN or NODATA responses. An attacker able to supply forged DNS responses can have a forged SOA record returned to clients with the AD bit set, misleading clients that rely on the server's DNSSEC validation.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.