---
id: "CVE-2026-123582"
page: "https://infrastack.ai/live/CVE-2026-123582"
kind: "vulnerability"
aliases: ["CVE-2026-123582"]
title: "Hickory DNS: forged SOA records pass as DNSSEC-validated to clients"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns", "dnssec", "hickory-dns", "hickory-server", "package", "rust"]
not_affected_if: ["no-dnssec-reliance", "no-validating-resolver", "version-0.26.2-or-later"]
published_at: "2026-11-08T02:16:51+00:00"
first_seen_at: "2026-11-08T02:21:12+00:00"
updated_at: "2026-11-08T02:25:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123582", "first_seen_at": "2026-11-08T02:21:12+00:00"}]
exploit_sources: []
---

# Hickory DNS: forged SOA records pass as DNSSEC-validated to clients

Link for people: https://infrastack.ai/live/CVE-2026-123582 (this .md is for agents)

Hickory DNS's validating resolver and forwarder do not check whether the SOA record in NXDOMAIN or NODATA answers passed DNSSEC validation. An attacker who can supply forged DNS responses can get a forged SOA returned to clients with the AD (authenticated data) bit set, so clients that trust the server's validation are misled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `hickory-server` version in your Cargo.lock or dependency tree; affected versions are 0.25.0 before 0.26.2.
- Confirm whether you run Hickory DNS as a validating recursive resolver or forwarder.

## Fix

- `hickory-server` `0.26.2`

## Timeline

- 2026-11-08T02:21:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123582

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-8hq4-5836-w6q4
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-0.25.0-before-0.26.2-dnssec-validation-bypass-via-soa-record

## From the sources

The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the SOA record passed DNSSEC validation when assembling NXDOMAIN or NODATA responses. An attacker able to supply forged DNS responses can have a forged SOA record returned to clients with the AD bit set, misleading clients that rely on the server's DNSSEC validation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_