{"id":"CVE-2026-123594","kind":"vulnerability","aliases":["CVE-2026-123594"],"related":[],"title":"Hickory DNS: forged NXDOMAIN answers accepted by DNSSEC validators","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually proves the name exists as an empty non-terminal. On-path attackers can flip the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN, causing validators to accept forged nonexistence of the name.","summary":"Hickory DNS libraries mishandle DNSSEC NSEC proofs, so a validator can accept a forged NXDOMAIN for a name that exists. An on-path attacker can flip a genuine NODATA response from NOERROR to NXDOMAIN and have it trusted.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","dnssec","hickory-dns","package","rust"],"not_affected_if":["no-dnssec-validation","not-using-hickory"],"how_to_check":"- Check the `hickory-proto` and `hickory-net` versions in Cargo.lock or `cargo tree` output\n- Look for `hickory-proto` at or below `0.26.0-alpha.1` or `hickory-net` at `0.26.0-beta.1`","fix":"- `hickory-proto` and `hickory-net`: move to `0.26.2` or later","status":"open","published_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:24:57+00:00","updated_at":"2026-11-08T02:24:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:24:57Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-proto` and `hickory-net`: move to `0.26.2` or later","reach":"network","title":"Hickory DNS: forged NXDOMAIN answers accepted by DNSSEC validators","impact":"medium","summary":"Hickory DNS libraries mishandle DNSSEC NSEC proofs, so a validator can accept a forged NXDOMAIN for a name that exists. An on-path attacker can flip a genuine NODATA response from NOERROR to NXDOMAIN and have it trusted.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dnssec","dns"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"forged nonexistence of a name is accepted by the validator","analyst_note":"","how_to_check":"- Check the `hickory-proto` and `hickory-net` versions in Cargo.lock or `cargo tree` output\n- Look for `hickory-proto` at or below `0.26.0-alpha.1` or `hickory-net` at `0.26.0-beta.1`","plain_action":"","needs_analyst":false,"not_affected_if":["no-dnssec-validation","not-using-hickory"],"who_is_affected":"Applications that use hickory-proto or hickory-net for DNS resolution with DNSSEC validation are exposed. Systems that do not validate DNSSEC, or that only use these crates for non-resolving tasks, are less exposed. Teams that do not depend on these crates can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4382,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123594':12A,15A '-2026':11A,14A '0.26.0':68C,74C '0.26.2':77C 'accept':6A,34B,141C 'actual':108C 'alpha.1':69C 'answer':5A 'attack':47B,122C 'beta.1':75C 'caus':138C 'contain':78C 'cover':93C 'cve':10A,13A 'descend':102C 'dns':2A,16B,20B,24B,63C 'dnssec':8A,17B,27B 'domain':97C 'empti':115C 'exist':42B,112C 'flaw':82C 'flip':49B,124C 'forg':3A,36B,142C 'genuin':51B,130C 'hickori':1A,19B,23B,62C,65C,72C 'hickory-dn':18B 'hickory-net':71C 'hickory-proto':64C 'librari':25B 'mishandl':26B 'name':40B,98C,106C,111C,146C 'net':73C 'next':96C 'nodata':52B,132C 'noerror':55B,135C 'non':117C 'non-termin':116C 'nonexist':143C 'nsec':28B,80C,94C 'nxdomain':4A,37B,57B,89C,137C 'on-path':44B,119C 'packag':21B 'path':46B,121C 'proof':29B,87C 'proto':66C 'prove':109C 'queri':105C 'rcode':127C 'respons':53B,90C,133C 'return':84C 'rust':22B 'secur':86C 'sign':131C 'strict':101C 'termin':118C 'trust':61B 'unsign':126C 'valid':9A,32B,81C,139C","nicknames":[],"mitigations":[],"who_affected":"Applications that use hickory-proto or hickory-net for DNS resolution with DNSSEC validation are exposed. Systems that do not validate DNSSEC, or that only use these crates for non-resolving tasks, are less exposed. Teams that do not depend on these crates can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","dnssec","hickorydns","medium","package","rust"],"campaign_type":null,"search_a":"'-123594':12A,15A '-2026':11A,14A 'accept':6A 'answer':5A 'cve':10A,13A 'dns':2A 'dnssec':8A 'forg':3A 'hickori':1A 'nxdomain':4A 'valid':9A","search_b":"'accept':34B 'attack':47B 'dns':16B,20B,24B 'dnssec':17B,27B 'exist':42B 'flip':49B 'forg':36B 'genuin':51B 'hickori':19B,23B 'hickory-dn':18B 'librari':25B 'mishandl':26B 'name':40B 'nodata':52B 'noerror':55B 'nsec':28B 'nxdomain':37B,57B 'on-path':44B 'packag':21B 'path':46B 'proof':29B 'respons':53B 'rust':22B 'trust':61B 'valid':32B","search_c":"'0.26.0':68C,74C '0.26.2':77C 'accept':141C 'actual':108C 'alpha.1':69C 'attack':122C 'beta.1':75C 'caus':138C 'contain':78C 'cover':93C 'descend':102C 'dns':63C 'domain':97C 'empti':115C 'exist':112C 'flaw':82C 'flip':124C 'forg':142C 'genuin':130C 'hickori':62C,65C,72C 'hickory-net':71C 'hickory-proto':64C 'name':98C,106C,111C,146C 'net':73C 'next':96C 'nodata':132C 'noerror':135C 'non':117C 'non-termin':116C 'nonexist':143C 'nsec':80C,94C 'nxdomain':89C,137C 'on-path':119C 'path':121C 'proof':87C 'proto':66C 'prove':109C 'queri':105C 'rcode':127C 'respons':90C,133C 'return':84C 'secur':86C 'sign':131C 'strict':101C 'termin':118C 'unsign':126C 'valid':81C,139C","first_public_at":"2026-09-03T21:00:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123594","severity":null,"published_at":"2026-11-08T02:16:53+00:00","modified_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99339,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-86vr-jm6c-7cpg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:00:03+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99340,"url":"https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-nsec-validation-bypass-for-empty-non-terminals","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}