---
id: "CVE-2026-123590"
page: "https://infrastack.ai/live/CVE-2026-123590"
kind: "vulnerability"
aliases: ["CVE-2026-123590"]
title: "Hickory DNS: forged DNSSEC nonexistence proofs accepted from attacker-supplied responses"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns", "dnssec", "hickory-dns", "package", "rust"]
not_affected_if: ["no-dnssec-validation", "not-using-hickory"]
published_at: "2026-11-08T02:16:53+00:00"
first_seen_at: "2026-11-08T02:21:13+00:00"
updated_at: "2026-11-08T02:25:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123590", "first_seen_at": "2026-11-08T02:21:13+00:00"}]
exploit_sources: []
---

# Hickory DNS: forged DNSSEC nonexistence proofs accepted from attacker-supplied responses

Link for people: https://infrastack.ai/live/CVE-2026-123590 (this .md is for agents)

Hickory DNS resolver libraries accept NSEC and NSEC3 records as DNSSEC nonexistence proofs when any other same-owner record validates. An attacker able to supply DNS responses can mix validly signed records with bogus NSEC or NSEC3 records to forge proofs that a name does not exist.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of `hickory-net` in `Cargo.lock` or `cargo tree` output; affected if it is `0.26.0-beta.1` before `0.26.2`.
- Check the version of `hickory-proto` in `Cargo.lock`; affected if it is `through 0.26.0-alpha.1`.
- Check whether the application uses hickory DNS for DNSSEC validation.

## Fix

- `hickory-net` `0.26.2` or later (from the advisory range: before `0.26.2`).
- `hickory-proto`: unknown, the sources do not give a fixed version for this package.

## Timeline

- 2026-11-08T02:21:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123590

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-improper-nsec-nsec3-signature-validation

## From the sources

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_