CVE-2026-123593 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS resolver libraries compare DNSKEY keys against DNSSEC trust anchors without checking the record name, so a key set made only of trusted keys is accepted without signature verification. An attacker who can spoof or control name server responses can swap a secure zone's DNSKEY set for the root zone's keys and keep it cached with a long TTL.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use the Hickory DNS Rust crates for DNSSEC-validating resolution are exposed, most of all those that accept responses from untrusted or spoofable name servers. Services that do not use these crates for DNS validation can skip it.
Not affected if managed-dns-resolver, no-dnssec-validation
Who cares dns-resolver, dnssec, hickory-dns, rust
hickory-net and hickory-proto in your lockfile or Cargo.lock.hickory-net 0.26.0-beta.1 or later beta builds before 0.26.2, and hickory-proto between 0.24.0 and 0.26.0-alpha.1.Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hickory-net: move to 0.26.2 or later.hickory-proto: the sources do not give a fixed version for the 0.24.0 to 0.26.0-alpha.1 range; unknown.