CVE-2026-123599 · Package
NO FIX YET · SEE WHAT TO DO
The Hickory DNS libraries (hickory-proto and hickory-net) skip signature verification for DNS records not in the IN class, yet still mark them as secure. An attacker who can supply DNS responses can forge child zone answers and pass them off as DNSSEC-validated.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications written in Rust that use the hickory-proto or hickory-net crates to resolve DNS with DNSSEC validation. The flaw needs an attacker able to supply DNS responses, such as an on-path or poisoned resolver position. Programs that do not use these crates, or that do not rely on DNSSEC validation, can skip it.
Not affected if no-dnssec-validation, not-using-hickory
Who cares dns-resolver, dnssec, hickory-dns, rust
cargo tree -i hickory-proto and cargo tree -i hickory-net0.26.0-beta.1 or later0.26.2 or laterHickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.