CVE-2026-123594 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS libraries mishandle DNSSEC NSEC proofs, so a validator can accept a forged NXDOMAIN for a name that exists. An on-path attacker can flip a genuine NODATA response from NOERROR to NXDOMAIN and have it trusted.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use hickory-proto or hickory-net for DNS resolution with DNSSEC validation are exposed. Systems that do not validate DNSSEC, or that only use these crates for non-resolving tasks, are less exposed. Teams that do not depend on these crates can skip it.
Not affected if no-dnssec-validation, not-using-hickory
Who cares dns, dnssec, hickory-dns, rust
hickory-proto and hickory-net versions in Cargo.lock or cargo tree outputhickory-proto at or below 0.26.0-alpha.1 or hickory-net at 0.26.0-beta.1hickory-proto and : move to or laterHickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually proves the name exists as an empty non-terminal. On-path attackers can flip the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN, causing validators to accept forged nonexistence of the name.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hickory-net0.26.2NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.