---
id: "CVE-2026-123587"
page: "https://infrastack.ai/live/CVE-2026-123587"
kind: "vulnerability"
aliases: ["CVE-2026-123587"]
title: "Hickory DNS crate: forged DNSSEC responses can hide any record"
severity: "high"
cvss: 8.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns-resolver", "dnssec", "hickory-dns", "package", "rust"]
not_affected_if: ["no-dnssec-validation", "version-0.26.2-or-later", "version-below-0.26.0"]
published_at: "2026-11-08T02:16:52+00:00"
first_seen_at: "2026-11-08T02:21:13+00:00"
updated_at: "2026-11-08T02:22:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123587", "first_seen_at": "2026-11-08T02:21:13+00:00"}]
exploit_sources: []
---

# Hickory DNS crate: forged DNSSEC responses can hide any record

Link for people: https://infrastack.ai/live/CVE-2026-123587 (this .md is for agents)

The hickory-net Rust crate's DNSSEC validation accepts an unvalidated SOA record when checking wraparound NSEC records. An attacker who can supply DNS responses can pair a genuine NSEC and RRSIG with a crafted SOA to forge proof that any record does not exist.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the `hickory-net` crate in `Cargo.lock` and check whether its version is `0.26.0` or later but below `0.26.2`.
- Run `cargo tree -i hickory-net` to see which projects pull it in and at what version.

## Fix

- `hickory-net` `0.26.2` (fixed version, from the advisory ranges: before 0.26.2 is affected).

## Timeline

- 2026-11-08T02:21:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123587

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-qw83-5pm2-ggp5
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-0.26.0-before-0.26.2-dnssec-nonexistence-forgery-via-wraparound-nsec

## From the sources

The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_