---
id: "CVE-2026-123599"
page: "https://infrastack.ai/live/CVE-2026-123599"
kind: "vulnerability"
aliases: ["CVE-2026-123599"]
title: "Hickory DNS: forged DNS class records bypass DNSSEC signature checks"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dns-resolver", "dnssec", "hickory-dns", "package", "rust"]
not_affected_if: ["no-dnssec-validation", "not-using-hickory"]
published_at: "2026-11-08T02:16:54+00:00"
first_seen_at: "2026-11-08T02:21:13+00:00"
updated_at: "2026-11-08T02:24:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123599", "first_seen_at": "2026-11-08T02:21:13+00:00"}]
exploit_sources: []
---

# Hickory DNS: forged DNS class records bypass DNSSEC signature checks

Link for people: https://infrastack.ai/live/CVE-2026-123599 (this .md is for agents)

The Hickory DNS libraries (hickory-proto and hickory-net) skip signature verification for DNS records not in the IN class, yet still mark them as secure. An attacker who can supply DNS responses can forge child zone answers and pass them off as DNSSEC-validated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of hickory-proto or hickory-net in your Cargo.lock: `cargo tree -i hickory-proto` and `cargo tree -i hickory-net`
- Confirm whether your application uses a Hickory resolver with DNSSEC validation enabled (unknown if the sources say more)

## Fix

- hickory-proto: `0.26.0-beta.1` or later
- hickory-net: `0.26.2` or later

## Timeline

- 2026-11-08T02:21:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123599

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wjgj-fvg9-65w9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-before-0.26.0-beta.1-dnssec-validation-bypass-via-non-in-class-records

## From the sources

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_