{"id":"CVE-2026-123582","kind":"vulnerability","aliases":["CVE-2026-123582"],"related":[],"title":"Hickory DNS: forged SOA records pass as DNSSEC-validated to clients","description":"The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the SOA record passed DNSSEC validation when assembling NXDOMAIN or NODATA responses. An attacker able to supply forged DNS responses can have a forged SOA record returned to clients with the AD bit set, misleading clients that rely on the server's DNSSEC validation.","summary":"Hickory DNS's validating resolver and forwarder do not check whether the SOA record in NXDOMAIN or NODATA answers passed DNSSEC validation. An attacker who can supply forged DNS responses can get a forged SOA returned to clients with the AD (authenticated data) bit set, so clients that trust the server's validation are misled.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","dnssec","hickory-dns","hickory-server","package","rust"],"not_affected_if":["no-dnssec-reliance","no-validating-resolver","version-0.26.2-or-later"],"how_to_check":"- Check the installed `hickory-server` version in your Cargo.lock or dependency tree; affected versions are 0.25.0 before 0.26.2.\n- Confirm whether you run Hickory DNS as a validating recursive resolver or forwarder.","fix":"- `hickory-server` `0.26.2`","status":"open","published_at":"2026-11-08T02:16:51+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:25:01+00:00","updated_at":"2026-11-08T02:25:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:25:01Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-server` `0.26.2`","reach":"network","title":"Hickory DNS: forged SOA records pass as DNSSEC-validated to clients","impact":"medium","summary":"Hickory DNS's validating resolver and forwarder do not check whether the SOA record in NXDOMAIN or NODATA answers passed DNSSEC validation. An attacker who can supply forged DNS responses can get a forged SOA returned to clients with the AD (authenticated data) bit set, so clients that trust the server's validation are misled.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hickory-dns","hickory-server","rust","dns","dnssec"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"clients accept forged negative DNS answers as DNSSEC-validated","analyst_note":"","how_to_check":"- Check the installed `hickory-server` version in your Cargo.lock or dependency tree; affected versions are 0.25.0 before 0.26.2.\n- Confirm whether you run Hickory DNS as a validating recursive resolver or forwarder.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.26.2-or-later","no-validating-resolver","no-dnssec-reliance"],"who_is_affected":"Teams running a Hickory DNS server (hickory-server 0.25.0 up to 0.26.2) as a validating recursive resolver or forwarder, where clients rely on its DNSSEC validation. Deployments that only use Hickory for authoritative answers or that do not rely on the AD bit are less exposed. The sources do not say more about configuration requirements.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4319,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123582':15A,18A '-2026':14A,17A '0.25.0':97C '0.26.2':99C 'abl':118C 'ad':69B,135C 'answer':47B 'assembl':111C 'attack':52B,117C 'authent':70B 'bit':72B,136C 'check':38B,102C 'client':12A,66B,75B,132C,139C 'cve':13A,16A 'data':71B 'dns':2A,19B,23B,30B,57B,93C,122C 'dnssec':9A,20B,49B,108C,146C 'dnssec-valid':8A 'forg':3A,56B,62B,121C,127C 'forward':35B,90C 'get':60B 'hickori':1A,22B,25B,29B,92C,95C 'hickory-dn':21B 'hickory-serv':24B,94C 'misl':83B 'mislead':138C 'nodata':46B,114C 'nxdomain':44B,112C 'packag':27B 'pass':6A,48B,107C 'record':5A,42B,106C,129C 'recurs':86C 'reli':141C 'resolv':33B,87C 'respons':58B,115C,123C 'return':64B,130C 'rust':28B 'server':26B,79B,96C,144C 'set':73B,137C 'soa':4A,41B,63B,105C,128C 'suppli':55B,120C 'trust':77B 'valid':10A,32B,50B,81B,85C,89C,109C,147C 'whether':39B,103C","nicknames":[],"mitigations":[],"who_affected":"Teams running a Hickory DNS server (hickory-server 0.25.0 up to 0.26.2) as a validating recursive resolver or forwarder, where clients rely on its DNSSEC validation. Deployments that only use Hickory for authoritative answers or that do not rely on the AD bit are less exposed. The sources do not say more about configuration requirements.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","dnssec","hickorydns","hickoryserver","medium","package","rust"],"campaign_type":null,"search_a":"'-123582':15A,18A '-2026':14A,17A 'client':12A 'cve':13A,16A 'dns':2A 'dnssec':9A 'dnssec-valid':8A 'forg':3A 'hickori':1A 'pass':6A 'record':5A 'soa':4A 'valid':10A","search_b":"'ad':69B 'answer':47B 'attack':52B 'authent':70B 'bit':72B 'check':38B 'client':66B,75B 'data':71B 'dns':19B,23B,30B,57B 'dnssec':20B,49B 'forg':56B,62B 'forward':35B 'get':60B 'hickori':22B,25B,29B 'hickory-dn':21B 'hickory-serv':24B 'misl':83B 'nodata':46B 'nxdomain':44B 'packag':27B 'pass':48B 'record':42B 'resolv':33B 'respons':58B 'return':64B 'rust':28B 'server':26B,79B 'set':73B 'soa':41B,63B 'suppli':55B 'trust':77B 'valid':32B,50B,81B 'whether':39B","search_c":"'0.25.0':97C '0.26.2':99C 'abl':118C 'ad':135C 'assembl':111C 'attack':117C 'bit':136C 'check':102C 'client':132C,139C 'dns':93C,122C 'dnssec':108C,146C 'forg':121C,127C 'forward':90C 'hickori':92C,95C 'hickory-serv':94C 'mislead':138C 'nodata':114C 'nxdomain':112C 'pass':107C 'record':106C,129C 'recurs':86C 'reli':141C 'resolv':87C 'respons':115C,123C 'return':130C 'server':96C,144C 'set':137C 'soa':105C,128C 'suppli':120C 'valid':85C,89C,109C,147C 'whether':103C","first_public_at":"2026-09-03T21:04:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123582","severity":null,"published_at":"2026-11-08T02:16:51+00:00","modified_at":"2026-11-08T02:16:51+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99315,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-8hq4-5836-w6q4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:04:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99316,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-dnssec-validation-bypass-via-soa-record","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}