CVE-2026-123590 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS resolver libraries accept NSEC and NSEC3 records as DNSSEC nonexistence proofs when any other same-owner record validates. An attacker able to supply DNS responses can mix validly signed records with bogus NSEC or NSEC3 records to forge proofs that a name does not exist.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed Hickory DNS libraries and use them to resolve or validate DNSSEC responses are exposed. An attacker must be able to supply or influence DNS responses the resolver receives, such as through on-path or spoofing positions. Applications that do not use Hickory for DNSSEC validation, or that do not depend on these crates, can skip it.
Not affected if no-dnssec-validation, not-using-hickory
Who cares dns, dnssec, hickory-dns, rust
hickory-net in Cargo.lock or cargo tree output; affected if it is 0.26.0-beta.1 before 0.26.2.hickory-proto in Cargo.lock; affected if it is through 0.26.0-alpha.1.Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hickory-net 0.26.2 or later (from the advisory range: before 0.26.2).hickory-proto: unknown, the sources do not give a fixed version for this package.