{"id":"CVE-2026-123592","kind":"vulnerability","aliases":["CVE-2026-123592"],"related":[],"title":"Hickory DNS: cache key flaw lets forged DNS answers skip DNSSEC checks","description":"The hickory-net crate in Hickory DNS 0.26.0-beta.1 before 0.26.2 allows DNSSEC validation bypass because Name's Hash ignores label lengths and ValidationCacheKey compares only that hash. An attacker controlling an unsigned delegation whose name differs from a signed target only in dot positions can prime an Insecure verdict, causing forged answers for the target to skip signature verification instead of returning SERVFAIL.","summary":"The hickory-net Rust crate in Hickory DNS 0.26.0-beta.1 mishandles its validation cache key, so names that differ only in dot positions can collide. An attacker controlling an unsigned delegation can make forged answers for a signed target skip signature verification.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnssec","hickory-dns","package","rust"],"not_affected_if":["not-validating-resolver"],"how_to_check":"- Check the `hickory-net` version in `Cargo.lock` or `Cargo.toml`; versions below `0.26.2` in the 0.26 line are affected.\n- Look for services that use Hickory DNS as a validating resolver.","fix":"- `hickory-net` `0.26.2` or later (per the NVD description, fixed before `0.26.2`)","status":"open","published_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:23:16+00:00","updated_at":"2026-11-08T02:23:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:23:16Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net` `0.26.2` or later (per the NVD description, fixed before `0.26.2`)","reach":"internet","title":"Hickory DNS: cache key flaw lets forged DNS answers skip DNSSEC checks","impact":"high","summary":"The hickory-net Rust crate in Hickory DNS 0.26.0-beta.1 mishandles its validation cache key, so names that differ only in dot positions can collide. An attacker controlling an unsigned delegation can make forged answers for a signed target skip signature verification.","audience":"developers","category":"package","nicknames":[],"who_cares":["hickory-dns","rust","dnssec","dns-resolver"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"forged DNS answers are accepted without signature checks","analyst_note":"Confirm the affected version range against the vendor advisory on github.com and the VulnCheck write-up; sources list only the NVD description.","how_to_check":"- Check the `hickory-net` version in `Cargo.lock` or `Cargo.toml`; versions below `0.26.2` in the 0.26 line are affected.\n- Look for services that use Hickory DNS as a validating resolver.","plain_action":"","needs_analyst":true,"not_affected_if":["not-validating-resolver"],"who_is_affected":"Teams that build or run software on the hickory-net crate in a DNSSEC-validating resolver. Systems that use Hickory DNS only as a stub or non-validating client, or that do not use the 0.26.0-beta.1 line, are less exposed. The sources do not give more detail on the exact deployment conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4335,"output_tokens":609,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123592':15A,18A '-2026':14A,17A '0.26.0':37B,79C '0.26.2':82C 'allow':83C 'answer':9A,63B,124C 'attack':55B,101C 'beta.1':38B,80C 'bypass':86C 'cach':3A,42B 'caus':122C 'check':12A 'collid':53B 'compar':96C 'control':56B,102C 'crate':33B,75C 'cve':13A,16A 'deleg':59B,105C 'differ':47B,108C 'dns':2A,8A,20B,25B,36B,78C 'dns-resolv':19B 'dnssec':11A,22B,84C 'dot':50B,115C 'flaw':5A 'forg':7A,62B,123C 'hash':90C,99C 'hickori':1A,24B,30B,35B,73C,77C 'hickory-dn':23B 'hickory-net':29B,72C 'ignor':91C 'insecur':120C 'instead':132C 'key':4A,43B 'label':92C 'length':93C 'let':6A 'make':61B 'mishandl':39B 'name':45B,88C,107C 'net':31B,74C 'packag':26B 'posit':51B,116C 'prime':118C 'resolv':21B 'return':134C 'rust':27B,32B 'servfail':135C 'sign':66B,111C 'signatur':69B,130C 'skip':10A,68B,129C 'target':67B,112C,127C 'unsign':58B,104C 'valid':41B,85C 'validationcachekey':95C 'verdict':121C 'verif':70B,131C 'whose':106C","nicknames":[],"mitigations":[],"who_affected":"Teams that build or run software on the hickory-net crate in a DNSSEC-validating resolver. Systems that use Hickory DNS only as a stub or non-validating client, or that do not use the 0.26.0-beta.1 line, are less exposed. The sources do not give more detail on the exact deployment conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsresolver","dnssec","hickorydns","high","package","rust"],"campaign_type":null,"search_a":"'-123592':15A,18A '-2026':14A,17A 'answer':9A 'cach':3A 'check':12A 'cve':13A,16A 'dns':2A,8A 'dnssec':11A 'flaw':5A 'forg':7A 'hickori':1A 'key':4A 'let':6A 'skip':10A","search_b":"'0.26.0':37B 'answer':63B 'attack':55B 'beta.1':38B 'cach':42B 'collid':53B 'control':56B 'crate':33B 'deleg':59B 'differ':47B 'dns':20B,25B,36B 'dns-resolv':19B 'dnssec':22B 'dot':50B 'forg':62B 'hickori':24B,30B,35B 'hickory-dn':23B 'hickory-net':29B 'key':43B 'make':61B 'mishandl':39B 'name':45B 'net':31B 'packag':26B 'posit':51B 'resolv':21B 'rust':27B,32B 'sign':66B 'signatur':69B 'skip':68B 'target':67B 'unsign':58B 'valid':41B 'verif':70B","search_c":"'0.26.0':79C '0.26.2':82C 'allow':83C 'answer':124C 'attack':101C 'beta.1':80C 'bypass':86C 'caus':122C 'compar':96C 'control':102C 'crate':75C 'deleg':105C 'differ':108C 'dns':78C 'dnssec':84C 'dot':115C 'forg':123C 'hash':90C,99C 'hickori':73C,77C 'hickory-net':72C 'ignor':91C 'insecur':120C 'instead':132C 'label':92C 'length':93C 'name':88C,107C 'net':74C 'posit':116C 'prime':118C 'return':134C 'servfail':135C 'sign':111C 'signatur':130C 'skip':129C 'target':112C,127C 'unsign':104C 'valid':85C 'validationcachekey':95C 'verdict':121C 'verif':131C 'whose':106C","first_public_at":"2026-09-03T21:13:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123592","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123592","severity":null,"published_at":"2026-11-08T02:16:53+00:00","modified_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99335,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-rx82-4p2j-j5cv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:13:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99336,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-validation-bypass-via-name-hash-collision","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}