{"id":"CVE-2026-123597","kind":"vulnerability","aliases":["CVE-2026-123597"],"related":[],"title":"Hickory DNS: transient DS lookup errors cached, causing zone-wide SERVFAIL","description":"Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.","summary":"Hickory DNS's DNSSEC validator caches temporary DS lookup failures (SERVFAIL, REFUSED, timeout) as bogus validation results. An attacker who can induce such a failure for a child zone's DS query makes every name in that zone return SERVFAIL until the cache entry expires.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnssec","hickory-dns","package","rust"],"not_affected_if":["authoritative-only","no-dnssec-validation"],"how_to_check":"- Check the `hickory-proto` and `hickory-net` versions in `Cargo.lock` or the dependency tree (`cargo tree -i hickory-proto`).\n- Confirm whether the DNSSEC validating resolver (`DnssecDnsHandle`) is in use in your build.","fix":"- `hickory-net`: `0.26.2` or later\n- `hickory-proto`: move past the affected range `0.25.0-alpha.1` through `0.26.0-alpha.1` (fixed version not stated in the sources)","status":"open","published_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:24:57+00:00","updated_at":"2026-11-08T02:24:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:24:57Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net`: `0.26.2` or later\n- `hickory-proto`: move past the affected range `0.25.0-alpha.1` through `0.26.0-alpha.1` (fixed version not stated in the sources)","reach":"network","title":"Hickory DNS: transient DS lookup errors cached, causing zone-wide SERVFAIL","impact":"low","summary":"Hickory DNS's DNSSEC validator caches temporary DS lookup failures (SERVFAIL, REFUSED, timeout) as bogus validation results. An attacker who can induce such a failure for a child zone's DS query makes every name in that zone return SERVFAIL until the cache entry expires.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dnssec","dns-resolver"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Names in an affected zone return SERVFAIL until cache expiry","analyst_note":"Confirm the fixed version for hickory-proto from the GitHub advisory and check whether the default resolver enables DNSSEC validation.","how_to_check":"- Check the `hickory-proto` and `hickory-net` versions in `Cargo.lock` or the dependency tree (`cargo tree -i hickory-proto`).\n- Confirm whether the DNSSEC validating resolver (`DnssecDnsHandle`) is in use in your build.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dnssec-validation","authoritative-only"],"who_is_affected":"Applications that embed Hickory DNS's DNSSEC-validating resolver in Rust code are exposed, since the flaw sits in the DS-fetch path of DnssecDnsHandle. Teams that use Hickory only as an authoritative server or do not enable DNSSEC validation can likely skip it. The sources do not say which default configurations enable the validator.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000792,"input_tokens":4373,"output_tokens":710,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123597':15A,18A '-2026':14A,17A '0.25.0':78C '0.26.0':81C '0.26.2':88C 'alpha.1':79C,82C 'attack':46B,112C 'bogus':42B,107C 'bug':92C 'cach':7A,33B,70B,101C,144C 'caus':8A,130C 'child':55B,124C 'child-zon':123C 'contain':89C 'cve':13A,16A 'dns':2A,20B,25B,29B,74C 'dns-resolv':19B 'dnssec':22B,31B,108C 'dnssecdnshandl':94C 'ds':4A,35B,58B,97C,103C,126C 'ds-fetch':96C 'entri':71B,145C 'error':6A,105C 'everi':61B 'expir':72B,148C 'failur':37B,52B 'fetch':98C 'hickori':1A,24B,28B,73C,76C,85C 'hickory-dn':23B 'hickory-net':84C 'hickory-proto':75C 'induc':49B,114C 'logic':91C 'lookup':5A,36B,104C 'make':60B 'name':62B,138C 'net':86C 'packag':26B 'path':99C 'proto':77C 'queri':59B,129C 'refus':39B,117C 'resolv':21B 'respons':120C 'result':44B 'return':66B,134C 'rust':27B 'servfail':12A,38B,67B,116C,135C 'sub':128C 'sub-queri':127C 'temporari':34B 'timeout':40B,119C 'transient':3A,102C 'ttl':147C 'valid':32B,43B,109C,132C 'verdict':110C 'wide':11A 'zone':10A,56B,65B,125C,141C 'zone-wid':9A","nicknames":[],"mitigations":[],"who_affected":"Applications that embed Hickory DNS's DNSSEC-validating resolver in Rust code are exposed, since the flaw sits in the DS-fetch path of DnssecDnsHandle. Teams that use Hickory only as an authoritative server or do not enable DNSSEC validation can likely skip it. The sources do not say which default configurations enable the validator.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsresolver","dnssec","hickorydns","medium","package","rust"],"campaign_type":null,"search_a":"'-123597':15A,18A '-2026':14A,17A 'cach':7A 'caus':8A 'cve':13A,16A 'dns':2A 'ds':4A 'error':6A 'hickori':1A 'lookup':5A 'servfail':12A 'transient':3A 'wide':11A 'zone':10A 'zone-wid':9A","search_b":"'attack':46B 'bogus':42B 'cach':33B,70B 'child':55B 'dns':20B,25B,29B 'dns-resolv':19B 'dnssec':22B,31B 'ds':35B,58B 'entri':71B 'everi':61B 'expir':72B 'failur':37B,52B 'hickori':24B,28B 'hickory-dn':23B 'induc':49B 'lookup':36B 'make':60B 'name':62B 'packag':26B 'queri':59B 'refus':39B 'resolv':21B 'result':44B 'return':66B 'rust':27B 'servfail':38B,67B 'temporari':34B 'timeout':40B 'valid':32B,43B 'zone':56B,65B","search_c":"'0.25.0':78C '0.26.0':81C '0.26.2':88C 'alpha.1':79C,82C 'attack':112C 'bogus':107C 'bug':92C 'cach':101C,144C 'caus':130C 'child':124C 'child-zon':123C 'contain':89C 'dns':74C 'dnssec':108C 'dnssecdnshandl':94C 'ds':97C,103C,126C 'ds-fetch':96C 'entri':145C 'error':105C 'expir':148C 'fetch':98C 'hickori':73C,76C,85C 'hickory-net':84C 'hickory-proto':75C 'induc':114C 'logic':91C 'lookup':104C 'name':138C 'net':86C 'path':99C 'proto':77C 'queri':129C 'refus':117C 'respons':120C 'return':134C 'servfail':116C,135C 'sub':128C 'sub-queri':127C 'timeout':119C 'transient':102C 'ttl':147C 'valid':109C,132C 'verdict':110C 'zone':125C,141C","first_public_at":"2026-09-03T21:53:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123597","severity":null,"published_at":"2026-11-08T02:16:54+00:00","modified_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99345,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-xv7c-h5g9-x25x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T21:53:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99346,"url":"https://www.vulncheck.com/advisories/hickory-dns-dnssec-validation-cache-poisoning-via-transient-ds-fetch-errors","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}