{"id":"CVE-2026-123587","kind":"vulnerability","aliases":["CVE-2026-123587"],"related":[],"title":"Hickory DNS crate: forged DNSSEC responses can hide any record","description":"The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.","summary":"The hickory-net Rust crate's DNSSEC validation accepts an unvalidated SOA record when checking wraparound NSEC records. An attacker who can supply DNS responses can pair a genuine NSEC and RRSIG with a crafted SOA to forge proof that any record does not exist.","severity":"high","cvss":8.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnssec","hickory-dns","package","rust"],"not_affected_if":["no-dnssec-validation","version-0.26.2-or-later","version-below-0.26.0"],"how_to_check":"- Look for the `hickory-net` crate in `Cargo.lock` and check whether its version is `0.26.0` or later but below `0.26.2`.\n- Run `cargo tree -i hickory-net` to see which projects pull it in and at what version.","fix":"- `hickory-net` `0.26.2` (fixed version, from the advisory ranges: before 0.26.2 is affected).","status":"open","published_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:22:38+00:00","updated_at":"2026-11-08T02:22:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:22:38Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net` `0.26.2` (fixed version, from the advisory ranges: before 0.26.2 is affected).","reach":"network","title":"Hickory DNS crate: forged DNSSEC responses can hide any record","impact":"high","summary":"The hickory-net Rust crate's DNSSEC validation accepts an unvalidated SOA record when checking wraparound NSEC records. An attacker who can supply DNS responses can pair a genuine NSEC and RRSIG with a crafted SOA to forge proof that any record does not exist.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dnssec","dns-resolver"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker forges proof that DNS records do not exist","analyst_note":"Confirm the affected version range and fixed version against the NVD and vendor advisory links, and check whether default DNSSEC validation is on in the crate.","how_to_check":"- Look for the `hickory-net` crate in `Cargo.lock` and check whether its version is `0.26.0` or later but below `0.26.2`.\n- Run `cargo tree -i hickory-net` to see which projects pull it in and at what version.","plain_action":"","needs_analyst":true,"not_affected_if":["version-below-0.26.0","version-0.26.2-or-later","no-dnssec-validation"],"who_is_affected":"Applications built with the hickory-net crate at version 0.26.0 or later but below 0.26.2 that perform DNSSEC validation on responses they receive. Exposure depends on whether the code path that validates DNSSEC is used and whether an attacker can supply or tamper with DNS responses, such as through a poisoned resolver or on-path position. Projects pinned to earlier or later versions, or not using DNSSEC validation, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000775,"input_tokens":4320,"output_tokens":686,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123587':13A,16A '-2026':12A,15A '0.26.0':83C '0.26.2':85C 'accept':35B,103C 'attack':46B,111C 'check':41B 'combin':118C 'compar':91C 'craft':61B,128C 'crate':3A,31B,82C 'cve':11A,14A 'dns':2A,18B,23B,50B,78C,115C 'dns-resolv':17B 'dnssec':5A,20B,33B,73C 'domain':94C 'even':106C 'exist':71B 'fail':109C 'forg':4A,64B,132C 'genuin':55B,120C 'hickori':1A,22B,28B,77C,80C 'hickory-dn':21B 'hickory-net':27B,79C 'hide':8A 'identifi':86C 'name':95C 'net':29B,81C 'next':93C 'nonexist':133C 'nsec':43B,56B,88C,121C 'packag':24B 'pair':53B 'proof':65B 'record':10A,39B,44B,68B,89C,99C,122C,130C 'resolv':19B 'respons':6A,51B,102C,116C 'rrset':136C 'rrsig':58B,125C 'rust':25B,30B 'soa':38B,62B,98C,105C,129C 'suppli':49B,114C 'unvalid':37B 'valid':34B,74C,110C 'wraparound':42B,87C","nicknames":[],"mitigations":[],"who_affected":"Applications built with the hickory-net crate at version 0.26.0 or later but below 0.26.2 that perform DNSSEC validation on responses they receive. Exposure depends on whether the code path that validates DNSSEC is used and whether an attacker can supply or tamper with DNS responses, such as through a poisoned resolver or on-path position. Projects pinned to earlier or later versions, or not using DNSSEC validation, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsresolver","dnssec","hickorydns","high","package","rust"],"campaign_type":null,"search_a":"'-123587':13A,16A '-2026':12A,15A 'crate':3A 'cve':11A,14A 'dns':2A 'dnssec':5A 'forg':4A 'hickori':1A 'hide':8A 'record':10A 'respons':6A","search_b":"'accept':35B 'attack':46B 'check':41B 'craft':61B 'crate':31B 'dns':18B,23B,50B 'dns-resolv':17B 'dnssec':20B,33B 'exist':71B 'forg':64B 'genuin':55B 'hickori':22B,28B 'hickory-dn':21B 'hickory-net':27B 'net':29B 'nsec':43B,56B 'packag':24B 'pair':53B 'proof':65B 'record':39B,44B,68B 'resolv':19B 'respons':51B 'rrsig':58B 'rust':25B,30B 'soa':38B,62B 'suppli':49B 'unvalid':37B 'valid':34B 'wraparound':42B","search_c":"'0.26.0':83C '0.26.2':85C 'accept':103C 'attack':111C 'combin':118C 'compar':91C 'craft':128C 'crate':82C 'dns':78C,115C 'dnssec':73C 'domain':94C 'even':106C 'fail':109C 'forg':132C 'genuin':120C 'hickori':77C,80C 'hickory-net':79C 'identifi':86C 'name':95C 'net':81C 'next':93C 'nonexist':133C 'nsec':88C,121C 'record':89C,99C,122C,130C 'respons':102C,116C 'rrset':136C 'rrsig':125C 'soa':98C,105C,129C 'suppli':114C 'valid':74C,110C 'wraparound':87C","first_public_at":"2026-09-03T20:37:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123587","severity":null,"published_at":"2026-11-08T02:16:52+00:00","modified_at":"2026-11-08T02:16:52+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99325,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-qw83-5pm2-ggp5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T20:37:29+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99326,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-before-0.26.2-dnssec-nonexistence-forgery-via-wraparound-nsec","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}