{"id":"CVE-2026-123590","kind":"vulnerability","aliases":["CVE-2026-123590"],"related":[],"title":"Hickory DNS: forged DNSSEC nonexistence proofs accepted from attacker-supplied responses","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.","summary":"Hickory DNS resolver libraries accept NSEC and NSEC3 records as DNSSEC nonexistence proofs when any other same-owner record validates. An attacker able to supply DNS responses can mix validly signed records with bogus NSEC or NSEC3 records to forge proofs that a name does not exist.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","dnssec","hickory-dns","package","rust"],"not_affected_if":["no-dnssec-validation","not-using-hickory"],"how_to_check":"- Check the version of `hickory-net` in `Cargo.lock` or `cargo tree` output; affected if it is `0.26.0-beta.1` before `0.26.2`.\n- Check the version of `hickory-proto` in `Cargo.lock`; affected if it is `through 0.26.0-alpha.1`.\n- Check whether the application uses hickory DNS for DNSSEC validation.","fix":"- `hickory-net` `0.26.2` or later (from the advisory range: before `0.26.2`).\n- `hickory-proto`: unknown, the sources do not give a fixed version for this package.","status":"open","published_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:25:01+00:00","updated_at":"2026-11-08T02:25:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:01Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net` `0.26.2` or later (from the advisory range: before `0.26.2`).\n- `hickory-proto`: unknown, the sources do not give a fixed version for this package.","reach":"network","title":"Hickory DNS: forged DNSSEC nonexistence proofs accepted from attacker-supplied responses","impact":"medium","summary":"Hickory DNS resolver libraries accept NSEC and NSEC3 records as DNSSEC nonexistence proofs when any other same-owner record validates. An attacker able to supply DNS responses can mix validly signed records with bogus NSEC or NSEC3 records to forge proofs that a name does not exist.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","dns","dnssec","hickory-dns"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker forges DNS nonexistence answers, spoofing names that do not exist.","analyst_note":"Confirm the fixed version for hickory-proto from the vendor advisory at github.com and the VulnCheck advisory at vulncheck.com.","how_to_check":"- Check the version of `hickory-net` in `Cargo.lock` or `cargo tree` output; affected if it is `0.26.0-beta.1` before `0.26.2`.\n- Check the version of `hickory-proto` in `Cargo.lock`; affected if it is `through 0.26.0-alpha.1`.\n- Check whether the application uses hickory DNS for DNSSEC validation.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dnssec-validation","not-using-hickory"],"who_is_affected":"Applications that embed Hickory DNS libraries and use them to resolve or validate DNSSEC responses are exposed. An attacker must be able to supply or influence DNS responses the resolver receives, such as through on-path or spoofing positions. Applications that do not use Hickory for DNSSEC validation, or that do not depend on these crates, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000808,"input_tokens":4352,"output_tokens":745,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123590':15A,18A '-2026':14A,17A '0.26.0':79C,88C '0.26.2':82C 'abl':49B,112C 'accept':7A,30B,90C 'alpha.1':89C 'attack':10A,48B,111C 'attacker-suppli':9A 'author':136C 'beta.1':80C 'bogus':60B,123C 'cve':13A,16A 'differ':132C 'dns':2A,19B,23B,27B,52B,75C,115C 'dnssec':4A,20B,36B,96C 'exist':73B 'forg':3A,66B,139C 'hickori':1A,22B,26B,74C,77C,85C 'hickory-dn':21B 'hickory-net':76C 'hickory-proto':84C 'librari':29B 'mix':55B,118C 'name':70B,107C,126C 'net':78C 'nonexist':5A,37B,97C,140C 'nsec':31B,61B,91C,127C 'nsec3':33B,63B,93C,129C 'owner':44B,106C 'packag':24B 'pass':108C 'proof':6A,38B,67B,98C,141C 'proto':86C 'record':34B,45B,58B,64B,94C,102C,121C,130C 'resolv':28B 'respons':12A,53B,116C 'rust':25B 'same-nam':124C 'same-own':42B 'section':137C 'sign':57B,120C 'signatur':109C 'suppli':11A,51B,114C 'type':133C 'valid':46B,56B,110C,119C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed Hickory DNS libraries and use them to resolve or validate DNSSEC responses are exposed. An attacker must be able to supply or influence DNS responses the resolver receives, such as through on-path or spoofing positions. Applications that do not use Hickory for DNSSEC validation, or that do not depend on these crates, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","dnssec","hickorydns","medium","package","rust"],"campaign_type":null,"search_a":"'-123590':15A,18A '-2026':14A,17A 'accept':7A 'attack':10A 'attacker-suppli':9A 'cve':13A,16A 'dns':2A 'dnssec':4A 'forg':3A 'hickori':1A 'nonexist':5A 'proof':6A 'respons':12A 'suppli':11A","search_b":"'abl':49B 'accept':30B 'attack':48B 'bogus':60B 'dns':19B,23B,27B,52B 'dnssec':20B,36B 'exist':73B 'forg':66B 'hickori':22B,26B 'hickory-dn':21B 'librari':29B 'mix':55B 'name':70B 'nonexist':37B 'nsec':31B,61B 'nsec3':33B,63B 'owner':44B 'packag':24B 'proof':38B,67B 'record':34B,45B,58B,64B 'resolv':28B 'respons':53B 'rust':25B 'same-own':42B 'sign':57B 'suppli':51B 'valid':46B,56B","search_c":"'0.26.0':79C,88C '0.26.2':82C 'abl':112C 'accept':90C 'alpha.1':89C 'attack':111C 'author':136C 'beta.1':80C 'bogus':123C 'differ':132C 'dns':75C,115C 'dnssec':96C 'forg':139C 'hickori':74C,77C,85C 'hickory-net':76C 'hickory-proto':84C 'mix':118C 'name':107C,126C 'net':78C 'nonexist':97C,140C 'nsec':91C,127C 'nsec3':93C,129C 'owner':106C 'pass':108C 'proof':98C,141C 'proto':86C 'record':94C,102C,121C,130C 'respons':116C 'same-nam':124C 'section':137C 'sign':120C 'signatur':109C 'suppli':114C 'type':133C 'valid':110C,119C","first_public_at":"2026-09-03T20:35:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123590","severity":null,"published_at":"2026-11-08T02:16:53+00:00","modified_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99331,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T20:35:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99332,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-improper-nsec-nsec3-signature-validation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}