CVE-2026-123587 · Package
NO FIX YET · SEE WHAT TO DO
The hickory-net Rust crate's DNSSEC validation accepts an unvalidated SOA record when checking wraparound NSEC records. An attacker who can supply DNS responses can pair a genuine NSEC and RRSIG with a crafted SOA to forge proof that any record does not exist.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications built with the hickory-net crate at version 0.26.0 or later but below 0.26.2 that perform DNSSEC validation on responses they receive. Exposure depends on whether the code path that validates DNSSEC is used and whether an attacker can supply or tamper with DNS responses, such as through a poisoned resolver or on-path position. Projects pinned to earlier or later versions, or not using DNSSEC validation, can skip it.
Not affected if no-dnssec-validation, version-0.26.2-or-later, version-below-0.26.0
Who cares dns-resolver, dnssec, hickory-dns, rust
hickory-net crate in Cargo.lock and check whether its version is 0.26.0 or later but below 0.26.2.cargo tree -i hickory-net to see which projects pull it in and at what version.hickory-net 0.26.2 (fixed version, from the advisory ranges: before 0.26.2 is affected).The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.