{"id":"CVE-2026-123595","kind":"vulnerability","aliases":["CVE-2026-123595"],"related":[],"title":"Hickory DNS: NSEC3 check lets forged responses deny existing names","description":"Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.","summary":"Hickory DNS's validating recursor accepts certain parent-side NSEC3 records as proof that a name does not exist, because it matches the closest encloser by hash without checking the type bitmap. An attacker who delivers one crafted response can get NXDOMAIN or NODATA cached as authenticated, making existing names at and below the zone cut unresolvable.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","dnssec","hickory-dns","package","rust"],"not_affected_if":["no-validating-recursor","stub-resolver-only"],"how_to_check":"- Check the version of `hickory-proto` and `hickory-net` in your lock files (for example `Cargo.lock`) and look for versions in the affected ranges.\n- Look for any service running a validating recursor built on these crates that is reachable from untrusted clients.","fix":"- `hickory-proto` and `hickory-net`: move to `0.26.2` or later (the affected range is `0.25` through `0.26.0-alpha.1` for hickory-proto and `0.26.0-beta.1` before `0.26.2` for hickory-net).","status":"open","published_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:22:39+00:00","updated_at":"2026-11-08T02:22:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:22:39Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-proto` and `hickory-net`: move to `0.26.2` or later (the affected range is `0.25` through `0.26.0-alpha.1` for hickory-proto and `0.26.0-beta.1` before `0.26.2` for hickory-net).","reach":"network","title":"Hickory DNS: NSEC3 check lets forged responses deny existing names","impact":"medium","summary":"Hickory DNS's validating recursor accepts certain parent-side NSEC3 records as proof that a name does not exist, because it matches the closest encloser by hash without checking the type bitmap. An attacker who delivers one crafted response can get NXDOMAIN or NODATA cached as authenticated, making existing names at and below the zone cut unresolvable.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dns","dnssec"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker causes existing names to be denied and cached as valid","analyst_note":"Confirm the affected ranges and fixed version against the vendor advisory on github.com and the VulnCheck advisory before relying on them.","how_to_check":"- Check the version of `hickory-proto` and `hickory-net` in your lock files (for example `Cargo.lock`) and look for versions in the affected ranges.\n- Look for any service running a validating recursor built on these crates that is reachable from untrusted clients.","plain_action":"","needs_analyst":true,"not_affected_if":["stub-resolver-only","no-validating-recursor"],"who_is_affected":"Applications that embed the Hickory DNS Rust crates to run a validating recursive resolver are exposed, since the flaw is in the resolver's handling of DNSSEC responses. Teams that only use Hickory as a stub client or do not ship a recursor built on these crates can likely skip it, though the sources do not say this explicitly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000793,"input_tokens":4411,"output_tokens":703,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123595':13A,16A '-2026':12A,15A '0.25':87C '0.26.0':89C,95C '0.26.2':98C '1':162C 'accept':29B,126C 'ad':161C 'alon':118C 'alpha.1':90C 'ancestor':131C 'ancestor-deleg':130C 'attack':58B,140C 'authent':71B 'beta.1':96C 'bitmap':56B,123C 'built':145C 'cach':69B,159C 'caus':153C 'certain':30B 'check':4A,53B,120C 'closest':48B,114C 'contain':99C 'craft':62B 'cut':80B,173C 'cve':11A,14A 'deleg':132C 'deliv':60B,142C 'deni':8A,163C 'dns':2A,17B,21B,25B,83C 'dnssec':18B,101C 'enclos':49B,115C 'exist':9A,43B,73B,166C 'flaw':103C 'forg':6A 'genuin':147C 'get':65B 'handler':110C 'hash':51B,117C 'hickori':1A,20B,24B,82C,85C,93C 'hickory-dn':19B 'hickory-net':92C 'hickory-proto':84C 'let':5A 'make':72B 'match':46B,112C 'name':10A,40B,74B,167C 'net':94C 'nodata':68B,156C 'nonexist':138C 'nsec3':3A,34B,109C,133C,150C 'nxdomain':66B,154C 'one':61B,143C 'packag':22B 'parent':32B,128C,149C 'parent-sid':31B,127C 'proof':37B,136C 'proto':86C 'record':35B,134C,151C 'recursor':28B,107C 'resolut':164C 'respons':7A,63B,144C 'rust':23B 'side':33B,129C 'sign':148C 'type':55B,122C 'unresolv':81B 'valid':27B,102C,106C 'without':52B,119C 'zone':79B,172C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed the Hickory DNS Rust crates to run a validating recursive resolver are exposed, since the flaw is in the resolver's handling of DNSSEC responses. Teams that only use Hickory as a stub client or do not ship a recursor built on these crates can likely skip it, though the sources do not say this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","dnssec","hickorydns","high","package","rust"],"campaign_type":null,"search_a":"'-123595':13A,16A '-2026':12A,15A 'check':4A 'cve':11A,14A 'deni':8A 'dns':2A 'exist':9A 'forg':6A 'hickori':1A 'let':5A 'name':10A 'nsec3':3A 'respons':7A","search_b":"'accept':29B 'attack':58B 'authent':71B 'bitmap':56B 'cach':69B 'certain':30B 'check':53B 'closest':48B 'craft':62B 'cut':80B 'deliv':60B 'dns':17B,21B,25B 'dnssec':18B 'enclos':49B 'exist':43B,73B 'get':65B 'hash':51B 'hickori':20B,24B 'hickory-dn':19B 'make':72B 'match':46B 'name':40B,74B 'nodata':68B 'nsec3':34B 'nxdomain':66B 'one':61B 'packag':22B 'parent':32B 'parent-sid':31B 'proof':37B 'record':35B 'recursor':28B 'respons':63B 'rust':23B 'side':33B 'type':55B 'unresolv':81B 'valid':27B 'without':52B 'zone':79B","search_c":"'0.25':87C '0.26.0':89C,95C '0.26.2':98C '1':162C 'accept':126C 'ad':161C 'alon':118C 'alpha.1':90C 'ancestor':131C 'ancestor-deleg':130C 'attack':140C 'beta.1':96C 'bitmap':123C 'built':145C 'cach':159C 'caus':153C 'check':120C 'closest':114C 'contain':99C 'cut':173C 'deleg':132C 'deliv':142C 'deni':163C 'dns':83C 'dnssec':101C 'enclos':115C 'exist':166C 'flaw':103C 'genuin':147C 'handler':110C 'hash':117C 'hickori':82C,85C,93C 'hickory-net':92C 'hickory-proto':84C 'match':112C 'name':167C 'net':94C 'nodata':156C 'nonexist':138C 'nsec3':109C,133C,150C 'nxdomain':154C 'one':143C 'parent':128C,149C 'parent-sid':127C 'proof':136C 'proto':86C 'record':134C,151C 'recursor':107C 'resolut':164C 'respons':144C 'side':129C 'sign':148C 'type':122C 'valid':102C,106C 'without':119C 'zone':172C","first_public_at":"2026-09-03T20:41:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123595","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123595","severity":null,"published_at":"2026-11-08T02:16:53+00:00","modified_at":"2026-11-08T02:16:53+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99341,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T20:41:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99342,"url":"https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}