{"id":"CVE-2026-123599","kind":"vulnerability","aliases":["CVE-2026-123599"],"related":[],"title":"Hickory DNS: forged DNS class records bypass DNSSEC signature checks","description":"Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.","summary":"The Hickory DNS libraries (hickory-proto and hickory-net) skip signature verification for DNS records not in the IN class, yet still mark them as secure. An attacker who can supply DNS responses can forge child zone answers and pass them off as DNSSEC-validated.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnssec","hickory-dns","package","rust"],"not_affected_if":["no-dnssec-validation","not-using-hickory"],"how_to_check":"- Check the version of hickory-proto or hickory-net in your Cargo.lock: `cargo tree -i hickory-proto` and `cargo tree -i hickory-net`\n- Confirm whether your application uses a Hickory resolver with DNSSEC validation enabled (unknown if the sources say more)","fix":"- hickory-proto: `0.26.0-beta.1` or later\n- hickory-net: `0.26.2` or later","status":"open","published_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","triaged_at":"2026-11-08T02:24:54+00:00","updated_at":"2026-11-08T02:24:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:24:54Z","model":"claude-haiku-5-5","output":{"fix":"- hickory-proto: `0.26.0-beta.1` or later\n- hickory-net: `0.26.2` or later","reach":"network","title":"Hickory DNS: forged DNS class records bypass DNSSEC signature checks","impact":"medium","summary":"The Hickory DNS libraries (hickory-proto and hickory-net) skip signature verification for DNS records not in the IN class, yet still mark them as secure. An attacker who can supply DNS responses can forge child zone answers and pass them off as DNSSEC-validated.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dnssec","dns-resolver"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"forged DNS answers are accepted as DNSSEC-validated","analyst_note":"","how_to_check":"- Check the version of hickory-proto or hickory-net in your Cargo.lock: `cargo tree -i hickory-proto` and `cargo tree -i hickory-net`\n- Confirm whether your application uses a Hickory resolver with DNSSEC validation enabled (unknown if the sources say more)","plain_action":"","needs_analyst":false,"not_affected_if":["no-dnssec-validation","not-using-hickory"],"who_is_affected":"Applications written in Rust that use the hickory-proto or hickory-net crates to resolve DNS with DNSSEC validation. The flaw needs an attacker able to supply DNS responses, such as an on-path or poisoned resolver position. Programs that do not use these crates, or that do not rely on DNSSEC validation, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4340,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123599':13A,16A '-2026':12A,15A '0.26.0':80C '0.26.2':87C 'abl':120C 'answer':65B 'attack':55B,119C 'authent':137C 'beta.1':81C 'bypass':7A,92C 'ch':128C 'check':10A 'child':63B,142C 'class':5A,47B,98C,131C 'contain':88C 'cve':11A,14A 'dns':2A,4A,18B,23B,28B,41B,59B,75C,97C,123C 'dns-resolv':17B 'dnskey':139C 'dnssec':8A,20B,72B,90C 'dnssec-valid':71B 'ds':134C 'forg':3A,62B,127C,141C 'hickori':1A,22B,27B,31B,35B,74C,77C,84C 'hickory-dn':21B 'hickory-net':34B,83C 'hickory-proto':30B,76C 'hs':130C 'ignor':96C 'includ':126C,133C 'librari':29B 'mark':50B,112C 'net':36B,85C 'non':104C 'non-in':103C 'packag':24B 'partit':100C 'pass':67B 'proto':32B,78C 'record':6A,42B,106C,117C,132C,135C 'resolv':19B 'respons':60B,124C,144C 'rrset':95C,101C 'rust':25B 'secur':53B,113C 'signatur':9A,38B,108C 'skip':37B,107C 'still':49B 'suppli':58B,122C 'valid':73B,91C 'verif':39B,109C 'verifi':94C,118C 'yet':48B,110C 'zone':64B,143C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Rust that use the hickory-proto or hickory-net crates to resolve DNS with DNSSEC validation. The flaw needs an attacker able to supply DNS responses, such as an on-path or poisoned resolver position. Programs that do not use these crates, or that do not rely on DNSSEC validation, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsresolver","dnssec","hickorydns","medium","package","rust"],"campaign_type":null,"search_a":"'-123599':13A,16A '-2026':12A,15A 'bypass':7A 'check':10A 'class':5A 'cve':11A,14A 'dns':2A,4A 'dnssec':8A 'forg':3A 'hickori':1A 'record':6A 'signatur':9A","search_b":"'answer':65B 'attack':55B 'child':63B 'class':47B 'dns':18B,23B,28B,41B,59B 'dns-resolv':17B 'dnssec':20B,72B 'dnssec-valid':71B 'forg':62B 'hickori':22B,27B,31B,35B 'hickory-dn':21B 'hickory-net':34B 'hickory-proto':30B 'librari':29B 'mark':50B 'net':36B 'packag':24B 'pass':67B 'proto':32B 'record':42B 'resolv':19B 'respons':60B 'rust':25B 'secur':53B 'signatur':38B 'skip':37B 'still':49B 'suppli':58B 'valid':73B 'verif':39B 'yet':48B 'zone':64B","search_c":"'0.26.0':80C '0.26.2':87C 'abl':120C 'attack':119C 'authent':137C 'beta.1':81C 'bypass':92C 'ch':128C 'child':142C 'class':98C,131C 'contain':88C 'dns':75C,97C,123C 'dnskey':139C 'dnssec':90C 'ds':134C 'forg':127C,141C 'hickori':74C,77C,84C 'hickory-net':83C 'hickory-proto':76C 'hs':130C 'ignor':96C 'includ':126C,133C 'mark':112C 'net':85C 'non':104C 'non-in':103C 'partit':100C 'proto':78C 'record':106C,117C,132C,135C 'respons':124C,144C 'rrset':95C,101C 'secur':113C 'signatur':108C 'skip':107C 'suppli':122C 'valid':91C 'verif':109C 'verifi':94C,118C 'yet':110C 'zone':143C","first_public_at":"2026-09-03T20:35:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123599","severity":null,"published_at":"2026-11-08T02:16:54+00:00","modified_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:13+00:00","fetched_at":"2026-11-08T02:21:13+00:00","note":null}],"documents":[{"id":99349,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wjgj-fvg9-65w9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T20:35:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99350,"url":"https://www.vulncheck.com/advisories/hickory-dns-before-0.26.0-beta.1-dnssec-validation-bypass-via-non-in-class-records","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}