{"id":"CVE-2026-123601","kind":"vulnerability","aliases":["CVE-2026-123601"],"related":[],"title":"Hickory DNS: inverted NSEC3 check lets forged responses deny real names","description":"Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of find_covering_record() in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to inject DNS responses can replay that NSEC3 record and its RRSIG to forge DNSSEC-validated negative responses denying legitimate names.","summary":"Hickory DNS libraries (hickory-proto and hickory-net) invert a comparison in NSEC3 wrap-around handling, so the last NSEC3 record in a zone covers almost every hash. An attacker who can inject DNS responses can replay that record and its signature to produce DNSSEC-validated negative answers that deny names that exist.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-resolver","dnssec","hickory-dns","package","rust"],"not_affected_if":["does-not-use-hickory","no-dnssec-validation"],"how_to_check":"- Check the `hickory-proto` and `hickory-net` versions in your `Cargo.lock` or dependency tree.\n- Flag `hickory-proto` 0.25.0 through 0.26.0-alpha.1, and `hickory-net` 0.26.0-beta.1, as affected.","fix":"- `hickory-net` and `hickory-proto`: move to `0.26.2` or later (per the NVD summary, fixed before 0.26.2).","status":"open","published_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","triaged_at":"2026-11-08T02:23:14+00:00","updated_at":"2026-11-08T02:23:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:14Z","model":"claude-haiku-5-5","output":{"fix":"- `hickory-net` and `hickory-proto`: move to `0.26.2` or later (per the NVD summary, fixed before 0.26.2).","reach":"network","title":"Hickory DNS: inverted NSEC3 check lets forged responses deny real names","impact":"medium","summary":"Hickory DNS libraries (hickory-proto and hickory-net) invert a comparison in NSEC3 wrap-around handling, so the last NSEC3 record in a zone covers almost every hash. An attacker who can inject DNS responses can replay that record and its signature to produce DNSSEC-validated negative answers that deny names that exist.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dnssec","dns-resolver"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker forges DNSSEC-validated denial responses for legitimate names","analyst_note":"Confirm the exact affected ranges and fixed version against the vendor advisory on github.com and the VulnCheck advisory; sources did not state how the NSEC3 record replay is exploited in practice.","how_to_check":"- Check the `hickory-proto` and `hickory-net` versions in your `Cargo.lock` or dependency tree.\n- Flag `hickory-proto` 0.25.0 through 0.26.0-alpha.1, and `hickory-net` 0.26.0-beta.1, as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["does-not-use-hickory","no-dnssec-validation"],"who_is_affected":"Applications written in Rust that use hickory-proto or hickory-net for DNS resolution or DNSSEC validation, especially resolvers that accept responses from untrusted network paths. Projects that do not use these crates, or that use other DNS stacks, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4367,"output_tokens":685,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123601':14A,17A '-2026':13A,16A '0.25.0':89C '0.26.0':91C,97C '0.26.2':100C 'abl':135C 'almost':55B 'alpha.1':92C 'answer':78B 'around':44B,109C 'attack':59B,134C 'beta.1':98C 'branch':110C 'check':5A 'comparison':39B 'cover':54B,113C,128C 'cve':12A,15A 'deni':9A,80B,155C 'dns':2A,19B,24B,28B,63B,85C,138C 'dns-resolv':18B 'dnssec':21B,75B,151C 'dnssec-valid':74B,150C 'everi':56B,129C 'except':131C 'exist':83B 'find':112C 'forg':7A,149C 'handl':45B 'hash':57B,126C,130C 'hickori':1A,23B,27B,31B,35B,84C,87C,95C 'hickory-dn':22B 'hickory-net':34B,94C 'hickory-proto':30B,86C 'inject':62B,137C 'invert':3A,37B,101C 'last':48B,119C 'legitim':156C 'let':6A 'librari':29B 'name':11A,81B,157C 'negat':77B,153C 'net':36B,96C 'nsec3':4A,41B,49B,120C,143C 'nsec3.rs':116C 'oper':104C 'owner':133C 'packag':25B 'produc':73B 'proto':32B,88C 'real':10A 'record':50B,68B,114C,121C,144C 'relat':103C 'replay':66B,141C 'resolv':20B 'respons':8A,64B,139C,154C 'ring':127C 'rrsig':147C 'rust':26B 'signatur':71B 'valid':76B,152C 'wrap':43B,108C 'wrap-around':42B,107C 'zone':53B,124C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Rust that use hickory-proto or hickory-net for DNS resolution or DNSSEC validation, especially resolvers that accept responses from untrusted network paths. Projects that do not use these crates, or that use other DNS stacks, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsresolver","dnssec","hickorydns","high","package","rust"],"campaign_type":null,"search_a":"'-123601':14A,17A '-2026':13A,16A 'check':5A 'cve':12A,15A 'deni':9A 'dns':2A 'forg':7A 'hickori':1A 'invert':3A 'let':6A 'name':11A 'nsec3':4A 'real':10A 'respons':8A","search_b":"'almost':55B 'answer':78B 'around':44B 'attack':59B 'comparison':39B 'cover':54B 'deni':80B 'dns':19B,24B,28B,63B 'dns-resolv':18B 'dnssec':21B,75B 'dnssec-valid':74B 'everi':56B 'exist':83B 'handl':45B 'hash':57B 'hickori':23B,27B,31B,35B 'hickory-dn':22B 'hickory-net':34B 'hickory-proto':30B 'inject':62B 'invert':37B 'last':48B 'librari':29B 'name':81B 'negat':77B 'net':36B 'nsec3':41B,49B 'packag':25B 'produc':73B 'proto':32B 'record':50B,68B 'replay':66B 'resolv':20B 'respons':64B 'rust':26B 'signatur':71B 'valid':76B 'wrap':43B 'wrap-around':42B 'zone':53B","search_c":"'0.25.0':89C '0.26.0':91C,97C '0.26.2':100C 'abl':135C 'alpha.1':92C 'around':109C 'attack':134C 'beta.1':98C 'branch':110C 'cover':113C,128C 'deni':155C 'dns':85C,138C 'dnssec':151C 'dnssec-valid':150C 'everi':129C 'except':131C 'find':112C 'forg':149C 'hash':126C,130C 'hickori':84C,87C,95C 'hickory-net':94C 'hickory-proto':86C 'inject':137C 'invert':101C 'last':119C 'legitim':156C 'name':157C 'negat':153C 'net':96C 'nsec3':120C,143C 'nsec3.rs':116C 'oper':104C 'owner':133C 'proto':88C 'record':114C,121C,144C 'relat':103C 'replay':141C 'respons':139C,154C 'ring':127C 'rrsig':147C 'valid':152C 'wrap':108C 'wrap-around':107C 'zone':124C","first_public_at":"2026-09-03T20:36:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123601","severity":null,"published_at":"2026-11-08T02:16:54+00:00","modified_at":"2026-11-08T02:16:54+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","fetched_at":"2026-11-08T02:21:14+00:00","note":null}],"documents":[{"id":99353,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-588m-chg6-8jqj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T20:36:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99354,"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-nsec3-proof-of-nonexistence-forgery","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}