{"id":"CVE-2026-123600","kind":"vulnerability","aliases":["CVE-2026-123600"],"related":[],"title":"Hickory DNS: DNSSEC check accepts forged denial-of-record responses for zone apex","description":"Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.","summary":"Hickory DNS's DNSSEC validator wrongly marks some zone-apex denial responses as authenticated without matching NSEC3 proof. An on-path attacker or malicious authoritative server can replay a valid non-apex NSEC3 record to make a record type appear nonexistent, authenticated, for the negative-cache TTL.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","dnssec","hickory-dns","package","rust"],"not_affected_if":["no-dnssec-validation","other-resolver"],"how_to_check":"- Check the `hickory-proto` version in your `Cargo.lock` for `0.25.0-alpha.3` through `0.25.2`\n- Check the `hickory-net` version in your `Cargo.lock` for `0.26.0-alpha.1` before `0.26.2`\n- Confirm whether your resolver uses the DNSSEC validation path (`DnssecDnsHandle`)","fix":"- `hickory-net`: move to `0.26.2` or later\n- `hickory-proto`: the sources give no fixed version for the 0.25 line; unknown","status":"open","published_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","triaged_at":"2026-11-08T02:24:53+00:00","updated_at":"2026-11-08T02:24:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:24:53Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net`: move to `0.26.2` or later\n- `hickory-proto`: the sources give no fixed version for the 0.25 line; unknown","reach":"network","title":"Hickory DNS: DNSSEC check accepts forged denial-of-record responses for zone apex","impact":"low","summary":"Hickory DNS's DNSSEC validator wrongly marks some zone-apex denial responses as authenticated without matching NSEC3 proof. An on-path attacker or malicious authoritative server can replay a valid non-apex NSEC3 record to make a record type appear nonexistent, authenticated, for the negative-cache TTL.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dnssec","dns"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"forged denial of record types reported as DNSSEC-authenticated","analyst_note":"Confirm the fixed hickory-proto version for the 0.25 line at the vendor advisory on github.com and the VulnCheck advisory.","how_to_check":"- Check the `hickory-proto` version in your `Cargo.lock` for `0.25.0-alpha.3` through `0.25.2`\n- Check the `hickory-net` version in your `Cargo.lock` for `0.26.0-alpha.1` before `0.26.2`\n- Confirm whether your resolver uses the DNSSEC validation path (`DnssecDnsHandle`)","plain_action":"","needs_analyst":true,"not_affected_if":["no-dnssec-validation","other-resolver"],"who_is_affected":"Applications built on the Rust Hickory DNS crates that perform DNSSEC validation through DnssecDnsHandle are exposed. Exposure requires an attacker able to sit on the network path or run a malicious authoritative server for a DNSSEC-signed zone. Systems that use other resolvers or do not validate DNSSEC can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000802,"input_tokens":4406,"output_tokens":722,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123600':17A,20A '-2026':16A,19A '0.25.0':84C '0.25.2':87C '0.26.0':92C '0.26.2':95C '1':153C 'accept':5A,104C 'ad':152C 'alpha.1':93C 'alpha.3':85C 'apex':14A,38B,62B,113C,140C,157C 'appear':70B 'attack':51B,128C 'authent':42B,72B,151C 'authorit':54B,131C 'cach':77B,163C 'check':4A 'contain':96C 'cve':15A,18A 'denial':8A,39B,154C 'denial-of-record':7A 'dns':2A,21B,25B,29B,80C 'dnssec':3A,22B,31B,98C 'dnssecdnshandl':102C 'flaw':100C 'forg':6A 'hash':123C 'hickori':1A,24B,28B,79C,82C,90C 'hickory-dn':23B 'hickory-net':89C 'hickory-proto':81C 'make':66B 'malici':53B,130C 'mark':34B 'match':44B,121C 'negat':76B,162C 'negative-cach':75B,161C 'net':91C 'nodata':108C 'non':61B,139C 'non-apex':60B,138C 'nonexist':71B 'nsec3':45B,63B,106C,119C,141C 'nsec3-signed':105C 'on-path':48B,125C 'packag':26B 'path':50B,127C 'proof':46B 'proto':83C 'qname':124C 'queri':114C 'record':10A,64B,68B,120C 'replay':57B,134C 'respons':11A,40B,109C 'rrtype':158C 'rust':27B 'secur':116C 'serv':149C 'server':55B,132C 'sign':107C,137C,146C 'soa':147C 'ttl':78B,164C 'type':69B 'valid':32B,59B,99C,136C 'without':43B,117C 'wrong':33B 'zone':13A,37B,112C,144C 'zone-apex':36B,111C","nicknames":[],"mitigations":[],"who_affected":"Applications built on the Rust Hickory DNS crates that perform DNSSEC validation through DnssecDnsHandle are exposed. Exposure requires an attacker able to sit on the network path or run a malicious authoritative server for a DNSSEC-signed zone. Systems that use other resolvers or do not validate DNSSEC can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","dnssec","hickorydns","medium","package","rust"],"campaign_type":null,"search_a":"'-123600':17A,20A '-2026':16A,19A 'accept':5A 'apex':14A 'check':4A 'cve':15A,18A 'denial':8A 'denial-of-record':7A 'dns':2A 'dnssec':3A 'forg':6A 'hickori':1A 'record':10A 'respons':11A 'zone':13A","search_b":"'apex':38B,62B 'appear':70B 'attack':51B 'authent':42B,72B 'authorit':54B 'cach':77B 'denial':39B 'dns':21B,25B,29B 'dnssec':22B,31B 'hickori':24B,28B 'hickory-dn':23B 'make':66B 'malici':53B 'mark':34B 'match':44B 'negat':76B 'negative-cach':75B 'non':61B 'non-apex':60B 'nonexist':71B 'nsec3':45B,63B 'on-path':48B 'packag':26B 'path':50B 'proof':46B 'record':64B,68B 'replay':57B 'respons':40B 'rust':27B 'server':55B 'ttl':78B 'type':69B 'valid':32B,59B 'without':43B 'wrong':33B 'zone':37B 'zone-apex':36B","search_c":"'0.25.0':84C '0.25.2':87C '0.26.0':92C '0.26.2':95C '1':153C 'accept':104C 'ad':152C 'alpha.1':93C 'alpha.3':85C 'apex':113C,140C,157C 'attack':128C 'authent':151C 'authorit':131C 'cach':163C 'contain':96C 'denial':154C 'dns':80C 'dnssec':98C 'dnssecdnshandl':102C 'flaw':100C 'hash':123C 'hickori':79C,82C,90C 'hickory-net':89C 'hickory-proto':81C 'malici':130C 'match':121C 'negat':162C 'negative-cach':161C 'net':91C 'nodata':108C 'non':139C 'non-apex':138C 'nsec3':106C,119C,141C 'nsec3-signed':105C 'on-path':125C 'path':127C 'proto':83C 'qname':124C 'queri':114C 'record':120C 'replay':134C 'respons':109C 'rrtype':158C 'secur':116C 'serv':149C 'server':132C 'sign':107C,137C,146C 'soa':147C 'ttl':164C 'valid':99C,136C 'without':117C 'zone':112C,144C 'zone-apex':111C","first_public_at":"2026-09-03T20:38:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123600","severity":null,"published_at":"2026-11-08T02:16:54+00:00","modified_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","fetched_at":"2026-11-08T02:21:14+00:00","note":null}],"documents":[{"id":99351,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3jvh-8vj5-65rq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T20:38:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99352,"url":"https://www.vulncheck.com/advisories/hickory-dns-hickory-proto-0.25.0-alpha.3-through-0.25.2-nsec3-apex-nodata-validation-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}