{"id":"CVE-2026-123596","kind":"vulnerability","aliases":["CVE-2026-123596"],"related":[],"title":"Hickory DNS: forged NXDOMAIN denies existing DNSSEC child-zone names","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. An on-path attacker, rogue parent nameserver, or attacker winning a port and TXID race can deliver one forged NXDOMAIN response built from genuinely signed parent NSEC records, causing authenticated denial of existing child-zone names cached for the negative TTL.","summary":"Hickory DNS's validating recursor accepts parent-side NSEC records as proof that names below a zone cut do not exist. An on-path attacker or rogue parent nameserver can send one forged NXDOMAIN, so existing child-zone names are denied and cached for the negative TTL.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnssec","hickory-dns","package","rust"],"not_affected_if":["dnssec-validation-off","no-validating-recursor"],"how_to_check":"- Check the `hickory-proto` and `hickory-net` versions in your Cargo.lock or dependency tree; affected if `hickory-proto` is through `0.26.0-alpha.1` or `hickory-net` is `0.26.0-beta.1`.\n- Check whether your service runs the Hickory validating recursor (resolver) rather than only an authoritative server or a client library.","fix":"- `hickory-net` and `hickory-proto`: move to `0.26.2` or later.","status":"open","published_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:22:38+00:00","updated_at":"2026-11-08T02:22:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:22:38Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net` and `hickory-proto`: move to `0.26.2` or later.","reach":"network","title":"Hickory DNS: forged NXDOMAIN denies existing DNSSEC child-zone names","impact":"medium","summary":"Hickory DNS's validating recursor accepts parent-side NSEC records as proof that names below a zone cut do not exist. An on-path attacker or rogue parent nameserver can send one forged NXDOMAIN, so existing child-zone names are denied and cached for the negative TTL.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dns-resolver","dnssec"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Existing child-zone names are denied to clients for the negative cache TTL","analyst_note":"","how_to_check":"- Check the `hickory-proto` and `hickory-net` versions in your Cargo.lock or dependency tree; affected if `hickory-proto` is through `0.26.0-alpha.1` or `hickory-net` is `0.26.0-beta.1`.\n- Check whether your service runs the Hickory validating recursor (resolver) rather than only an authoritative server or a client library.","plain_action":"","needs_analyst":false,"not_affected_if":["no-validating-recursor","dnssec-validation-off"],"who_is_affected":"Only teams running the Hickory validating recursor with DNSSEC validation enabled are exposed; the flaw is in the NSEC handling of that recursor. Applications that only use the library for authoritative serving or that do not validate DNSSEC can skip it, though they should still update the crate version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4398,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123596':14A,17A '-2026':13A,16A '0.26.0':83C,89C '0.26.2':92C 'accept':32B,106C 'alpha.1':84C 'ancestor':111C 'ancestor-deleg':110C 'attack':53B,129C,134C 'authent':155C 'beta.1':90C 'built':147C 'cach':72B,163C 'caus':154C 'child':9A,66B,160C 'child-zon':8A,65B,159C 'contain':93C 'cut':45B,124C 'cve':12A,15A 'deleg':112C 'deliv':142C 'deni':5A,70B 'denial':156C 'dns':2A,19B,24B,28B,78C 'dns-resolv':18B 'dnssec':7A,21B,95C 'exist':6A,48B,64B,158C 'flaw':97C 'forg':3A,61B,144C 'genuin':149C 'handler':104C 'hickori':1A,23B,27B,77C,80C,87C 'hickory-dn':22B 'hickory-net':86C 'hickory-proto':79C 'name':11A,41B,68B,120C,162C 'nameserv':57B,132C 'negat':75B,166C 'net':88C 'nonexist':118C 'nsec':36B,103C,113C,152C 'nxdomain':4A,62B,145C 'on-path':50B,126C 'one':60B,143C 'packag':25B 'parent':34B,56B,108C,131C,151C 'parent-sid':33B,107C 'path':52B,128C 'port':137C 'proof':39B,116C 'proto':81C 'race':140C 'record':37B,114C,153C 'recursor':31B,101C 'resolv':20B 'respons':146C 'rogu':55B,130C 'rust':26B 'send':59B 'side':35B,109C 'sign':150C 'ttl':76B,167C 'txid':139C 'valid':30B,96C,100C 'win':135C 'zone':10A,44B,67B,123C,161C","nicknames":[],"mitigations":[],"who_affected":"Only teams running the Hickory validating recursor with DNSSEC validation enabled are exposed; the flaw is in the NSEC handling of that recursor. Applications that only use the library for authoritative serving or that do not validate DNSSEC can skip it, though they should still update the crate version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsresolver","dnssec","hickorydns","high","package","rust"],"campaign_type":null,"search_a":"'-123596':14A,17A '-2026':13A,16A 'child':9A 'child-zon':8A 'cve':12A,15A 'deni':5A 'dns':2A 'dnssec':7A 'exist':6A 'forg':3A 'hickori':1A 'name':11A 'nxdomain':4A 'zone':10A","search_b":"'accept':32B 'attack':53B 'cach':72B 'child':66B 'child-zon':65B 'cut':45B 'deni':70B 'dns':19B,24B,28B 'dns-resolv':18B 'dnssec':21B 'exist':48B,64B 'forg':61B 'hickori':23B,27B 'hickory-dn':22B 'name':41B,68B 'nameserv':57B 'negat':75B 'nsec':36B 'nxdomain':62B 'on-path':50B 'one':60B 'packag':25B 'parent':34B,56B 'parent-sid':33B 'path':52B 'proof':39B 'record':37B 'recursor':31B 'resolv':20B 'rogu':55B 'rust':26B 'send':59B 'side':35B 'ttl':76B 'valid':30B 'zone':44B,67B","search_c":"'0.26.0':83C,89C '0.26.2':92C 'accept':106C 'alpha.1':84C 'ancestor':111C 'ancestor-deleg':110C 'attack':129C,134C 'authent':155C 'beta.1':90C 'built':147C 'cach':163C 'caus':154C 'child':160C 'child-zon':159C 'contain':93C 'cut':124C 'deleg':112C 'deliv':142C 'denial':156C 'dns':78C 'dnssec':95C 'exist':158C 'flaw':97C 'forg':144C 'genuin':149C 'handler':104C 'hickori':77C,80C,87C 'hickory-net':86C 'hickory-proto':79C 'name':120C,162C 'nameserv':132C 'negat':166C 'net':88C 'nonexist':118C 'nsec':103C,113C,152C 'nxdomain':145C 'on-path':126C 'one':143C 'parent':108C,131C,151C 'parent-sid':107C 'path':128C 'port':137C 'proof':116C 'proto':81C 'race':140C 'record':114C,153C 'recursor':101C 'respons':146C 'rogu':130C 'side':109C 'sign':150C 'ttl':167C 'txid':139C 'valid':96C,100C 'win':135C 'zone':123C,161C","first_public_at":"2026-09-03T20:40:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123596","severity":null,"published_at":"2026-11-08T02:16:54+00:00","modified_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99343,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3r6v-f3jh-vvqm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T20:40:08+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99344,"url":"https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}