CVE-2026-123600 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS's DNSSEC validator wrongly marks some zone-apex denial responses as authenticated without matching NSEC3 proof. An on-path attacker or malicious authoritative server can replay a valid non-apex NSEC3 record to make a record type appear nonexistent, authenticated, for the negative-cache TTL.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications built on the Rust Hickory DNS crates that perform DNSSEC validation through DnssecDnsHandle are exposed. Exposure requires an attacker able to sit on the network path or run a malicious authoritative server for a DNSSEC-signed zone. Systems that use other resolvers or do not validate DNSSEC can skip it.
Not affected if no-dnssec-validation, other-resolver
Who cares dns, dnssec, hickory-dns, rust
hickory-proto version in your Cargo.lock for 0.25.0-alpha.3 through 0.25.2hickory-net version in your Cargo.lock for 0.26.0-alpha.1 before 0.26.2DnssecDnsHandle)Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
hickory-net: move to 0.26.2 or laterhickory-proto: the sources give no fixed version for the 0.25 line; unknownNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.