---
id: "CVE-2026-123595"
page: "https://infrastack.ai/live/CVE-2026-123595"
kind: "vulnerability"
aliases: ["CVE-2026-123595"]
title: "Hickory DNS: NSEC3 check lets forged responses deny existing names"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns", "dnssec", "hickory-dns", "package", "rust"]
not_affected_if: ["no-validating-recursor", "stub-resolver-only"]
published_at: "2026-11-08T02:16:53+00:00"
first_seen_at: "2026-11-08T02:21:13+00:00"
updated_at: "2026-11-08T02:22:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123595", "first_seen_at": "2026-11-08T02:21:13+00:00"}]
exploit_sources: []
---

# Hickory DNS: NSEC3 check lets forged responses deny existing names

Link for people: https://infrastack.ai/live/CVE-2026-123595 (this .md is for agents)

Hickory DNS's validating recursor accepts certain parent-side NSEC3 records as proof that a name does not exist, because it matches the closest encloser by hash without checking the type bitmap. An attacker who delivers one crafted response can get NXDOMAIN or NODATA cached as authenticated, making existing names at and below the zone cut unresolvable.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of `hickory-proto` and `hickory-net` in your lock files (for example `Cargo.lock`) and look for versions in the affected ranges.
- Look for any service running a validating recursor built on these crates that is reachable from untrusted clients.

## Fix

- `hickory-proto` and `hickory-net`: move to `0.26.2` or later (the affected range is `0.25` through `0.26.0-alpha.1` for hickory-proto and `0.26.0-beta.1` before `0.26.2` for hickory-net).

## Timeline

- 2026-11-08T02:21:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123595

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3

## From the sources

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_