CVE-2026-123598 · Package
NO FIX YET · SEE WHAT TO DO
The validating DNS recursor in Hickory DNS caches DNSSEC-bogus answers using the attacker-supplied record TTL instead of a short failure TTL. A remote attacker who spoofs one authoritative response with an invalid signature and a long TTL can keep the bad result cached for up to 24 hours.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that build Rust software on the Hickory DNS libraries and run the validating recursor or resolver with DNSSEC validation. Applications that only use a system or public resolver, or that do not enable DNSSEC validation, are not exposed through this path.
Not affected if managed-dns, no-dnssec-validation, system-resolver
Who cares dns, dnssec, hickory-dns, rust
cargo tree -i hickory-resolver0.26.2 or laterThe validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.