CVE-2026-123595 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS's validating recursor accepts certain parent-side NSEC3 records as proof that a name does not exist, because it matches the closest encloser by hash without checking the type bitmap. An attacker who delivers one crafted response can get NXDOMAIN or NODATA cached as authenticated, making existing names at and below the zone cut unresolvable.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed the Hickory DNS Rust crates to run a validating recursive resolver are exposed, since the flaw is in the resolver's handling of DNSSEC responses. Teams that only use Hickory as a stub client or do not ship a recursor built on these crates can likely skip it, though the sources do not say this explicitly.
Not affected if no-validating-recursor, stub-resolver-only
Who cares dns, dnssec, hickory-dns, rust
hickory-proto and hickory-net in your lock files (for example Cargo.lock) and look for versions in the affected ranges.hickory-proto and hickory-net: move to 0.26.2 or later (the affected range is 0.25 through for hickory-proto and before for hickory-net).Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.26.0-alpha.10.26.0-beta.10.26.2NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.