CVE-2026-123597 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS's DNSSEC validator caches temporary DS lookup failures (SERVFAIL, REFUSED, timeout) as bogus validation results. An attacker who can induce such a failure for a child zone's DS query makes every name in that zone return SERVFAIL until the cache entry expires.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that embed Hickory DNS's DNSSEC-validating resolver in Rust code are exposed, since the flaw sits in the DS-fetch path of DnssecDnsHandle. Teams that use Hickory only as an authoritative server or do not enable DNSSEC validation can likely skip it. The sources do not say which default configurations enable the validator.
Not affected if authoritative-only, no-dnssec-validation
Who cares dns-resolver, dnssec, hickory-dns, rust
hickory-proto and hickory-net versions in Cargo.lock or the dependency tree (cargo tree -i hickory-proto).DnssecDnsHandle) is in use in your build.hickory-net: 0.26.2 or laterHickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hickory-proto: move past the affected range 0.25.0-alpha.1 through 0.26.0-alpha.1 (fixed version not stated in the sources)