CVE-2026-123601 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS libraries (hickory-proto and hickory-net) invert a comparison in NSEC3 wrap-around handling, so the last NSEC3 record in a zone covers almost every hash. An attacker who can inject DNS responses can replay that record and its signature to produce DNSSEC-validated negative answers that deny names that exist.
first public Sep 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications written in Rust that use hickory-proto or hickory-net for DNS resolution or DNSSEC validation, especially resolvers that accept responses from untrusted network paths. Projects that do not use these crates, or that use other DNS stacks, can skip it.
Not affected if does-not-use-hickory, no-dnssec-validation
Who cares dns-resolver, dnssec, hickory-dns, rust
hickory-proto and hickory-net versions in your Cargo.lock or dependency tree.hickory-proto 0.25.0 through 0.26.0-alpha.1, and hickory-net 0.26.0-beta.1, as affected.hickory-net and hickory-proto: move to 0.26.2 or later (per the NVD summary, fixed before 0.26.2).Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of find_covering_record() in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to inject DNS responses can replay that NSEC3 record and its RRSIG to forge DNSSEC-validated negative responses denying legitimate names.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.