{"id":"CVE-2026-123591","kind":"vulnerability","aliases":["CVE-2026-123591"],"related":[],"title":"Hickory DNS: unverified NSEC proofs let attackers forge child-zone DNS records","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 fail to verify, per RFC 6840 §4.4, that an NSEC or NSEC3 record denying a DS RRset also proves the delegation's NS record exists. Attackers can reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records.","summary":"Hickory DNS, a Rust DNS library, fails to check that a denial-of-existence record for a DS record also proves the delegation exists. An attacker can reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge records in the child zone.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnssec","package","rust"],"not_affected_if":["no-dnssec-validation","other-dns-library"],"how_to_check":"- Check the version of `hickory-net` in `Cargo.lock` or `Cargo.toml`; affected if it is `0.26.0-beta.1` before `0.26.2`.\n- Check the version of `hickory-proto` in `Cargo.lock`; affected if it is `0.26.0-alpha.1` or earlier.","fix":"- `hickory-net`: `0.26.2`\n- `hickory-proto`: unknown (sources give no fixed version for this package)","status":"open","published_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:23:18+00:00","updated_at":"2026-11-08T02:23:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:18Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net`: `0.26.2`\n- `hickory-proto`: unknown (sources give no fixed version for this package)","reach":"network","title":"Hickory DNS: unverified NSEC proofs let attackers forge child-zone DNS records","impact":"high","summary":"Hickory DNS, a Rust DNS library, fails to check that a denial-of-existence record for a DS record also proves the delegation exists. An attacker can reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge records in the child zone.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","dnssec","dns-resolver"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker forges DNS records in a child zone for clients","analyst_note":"Confirm the hickory-proto fixed version from the GitHub advisory (https://github.com) and the VulnCheck advisory before relying on the fix field.","how_to_check":"- Check the version of `hickory-net` in `Cargo.lock` or `Cargo.toml`; affected if it is `0.26.0-beta.1` before `0.26.2`.\n- Check the version of `hickory-proto` in `Cargo.lock`; affected if it is `0.26.0-alpha.1` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dnssec-validation","other-dns-library"],"who_is_affected":"Applications that embed hickory-net or hickory-proto in a DNS resolver or validating client that relies on DNSSEC. Software that only uses other DNS libraries, or hickory without DNSSEC validation, is outside the stated range. The sources do not say whether managed services are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4340,"output_tokens":644,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123591':16A,19A '-2026':15A,18A '0.26.0':79C,88C '0.26.2':82C '4.4':96C '6840':95C 'alpha.1':89C 'also':46B,107C 'attack':7A,52B,115C 'beta.1':80C 'check':34B 'child':10A,56B,72B,119C,133C 'child-sid':55B,118C 'child-zon':9A,132C 'cve':14A,17A 'deleg':49B,66B,110C,129C 'deni':103C 'denial':38B 'denial-of-exist':37B 'dns':2A,12A,21B,27B,30B,75C 'dns-resolv':20B 'dnssec':23B 'ds':44B,105C 'exist':40B,50B,114C 'fail':32B,90C 'fake':63B,126C 'forg':8A,68B,131C 'hickori':1A,26B,74C,77C,85C 'hickory-net':76C 'hickory-proto':84C 'insecur':65B,128C 'let':6A 'librari':31B 'net':78C 'ns':112C 'nsec':4A,58B,99C,121C 'nsec3':60B,101C,123C 'packag':24B 'per':93C 'proof':5A 'proto':86C 'prove':47B,108C 'record':13A,41B,45B,61B,69B,102C,113C,124C,135C 'resolv':22B 'reus':54B,117C 'rfc':94C 'rrset':106C 'rust':25B,29B 'side':57B,120C 'unverifi':3A 'verifi':92C 'zone':11A,73B,134C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed hickory-net or hickory-proto in a DNS resolver or validating client that relies on DNSSEC. Software that only uses other DNS libraries, or hickory without DNSSEC validation, is outside the stated range. The sources do not say whether managed services are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsresolver","dnssec","high","package","rust"],"campaign_type":null,"search_a":"'-123591':16A,19A '-2026':15A,18A 'attack':7A 'child':10A 'child-zon':9A 'cve':14A,17A 'dns':2A,12A 'forg':8A 'hickori':1A 'let':6A 'nsec':4A 'proof':5A 'record':13A 'unverifi':3A 'zone':11A","search_b":"'also':46B 'attack':52B 'check':34B 'child':56B,72B 'child-sid':55B 'deleg':49B,66B 'denial':38B 'denial-of-exist':37B 'dns':21B,27B,30B 'dns-resolv':20B 'dnssec':23B 'ds':44B 'exist':40B,50B 'fail':32B 'fake':63B 'forg':68B 'hickori':26B 'insecur':65B 'librari':31B 'nsec':58B 'nsec3':60B 'packag':24B 'prove':47B 'record':41B,45B,61B,69B 'resolv':22B 'reus':54B 'rust':25B,29B 'side':57B 'zone':73B","search_c":"'0.26.0':79C,88C '0.26.2':82C '4.4':96C '6840':95C 'alpha.1':89C 'also':107C 'attack':115C 'beta.1':80C 'child':119C,133C 'child-sid':118C 'child-zon':132C 'deleg':110C,129C 'deni':103C 'dns':75C 'ds':105C 'exist':114C 'fail':90C 'fake':126C 'forg':131C 'hickori':74C,77C,85C 'hickory-net':76C 'hickory-proto':84C 'insecur':128C 'net':78C 'ns':112C 'nsec':99C,121C 'nsec3':101C,123C 'per':93C 'proto':86C 'prove':108C 'record':102C,113C,124C,135C 'reus':117C 'rfc':94C 'rrset':106C 'side':120C 'verifi':92C 'zone':134C","first_public_at":"2026-09-03T20:50:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123591","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123591","severity":null,"published_at":"2026-11-08T02:16:53+00:00","modified_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99333,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-7php-9j59-g3ch","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T20:50:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99334,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-missing-rfc-6840-checks","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}