{"id":"CVE-2026-123605","kind":"vulnerability","aliases":["CVE-2026-123605"],"related":[],"title":"Hickory DNS: DNSSEC check accepts forged records from unrelated zones","description":"Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.","summary":"Hickory DNS's DNSSEC validator checks signatures against the key of whatever zone name the signature claims, not the zone that owns the records. An attacker who controls any signed zone can forge records for other zones that resolvers and clients accept as authenticated.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dnssec","hickory-dns","package","resolver","rust"],"not_affected_if":["no-dnssec-validation","not-using-dnssecdnshandle"],"how_to_check":"- Check the hickory-proto and hickory-net versions in your `Cargo.lock`; affected are hickory-proto `0.1` through `0.25.0-alpha.3` and hickory-net before `0.26.2`.\n- Look for uses of `DnssecDnsHandle` in your code.","fix":"- hickory-net: move to `0.26.2` or later (per the NVD description).\n- hickory-proto: the NVD description gives the affected range only; the fixed version is unknown.","status":"open","published_at":"2026-11-08T02:16:55+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","triaged_at":"2026-11-08T02:22:38+00:00","updated_at":"2026-11-08T02:22:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:22:38Z","model":"claude-haiku-5-5","output":{"fix":"- hickory-net: move to `0.26.2` or later (per the NVD description).\n- hickory-proto: the NVD description gives the affected range only; the fixed version is unknown.","reach":"network","title":"Hickory DNS: DNSSEC check accepts forged records from unrelated zones","impact":"high","summary":"Hickory DNS's DNSSEC validator checks signatures against the key of whatever zone name the signature claims, not the zone that owns the records. An attacker who controls any signed zone can forge records for other zones that resolvers and clients accept as authenticated.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","hickory-dns","dnssec","resolver"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"forged DNS records from unrelated zones are accepted as authenticated","analyst_note":"Confirm the hickory-proto fixed version and the vendor advisory at github.com before relying on the fix field.","how_to_check":"- Check the hickory-proto and hickory-net versions in your `Cargo.lock`; affected are hickory-proto `0.1` through `0.25.0-alpha.3` and hickory-net before `0.26.2`.\n- Look for uses of `DnssecDnsHandle` in your code.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dnssec-validation","not-using-dnssecdnshandle"],"who_is_affected":"Applications built on the Hickory DNS Rust crates that perform DNSSEC validation, including resolvers, recursors and clients using DnssecDnsHandle, are exposed. Systems that do not use these crates for DNSSEC validation can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4365,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123605':13A,16A '-2026':12A,15A '0.1':73C '0.25.0':75C '0.26.2':82C 'accept':5A,65B,140C 'alpha.3':76C 'appear':100C 'arbitrari':128C 'attack':49B,118C 'authent':67B,142C 'bypass':87C 'check':4A,29B,108C 'claim':40B 'client':64B,137C 'contain':83C,115C 'control':51B,119C 'cve':11A,14A 'dns':2A,20B,25B,69C 'dnskey':96C 'dnssec':3A,17B,27B,85C 'dnssecdnshandl':139C 'field':106C 'forg':6A,56B 'hickori':1A,19B,24B,68C,71C,79C 'hickory-dn':18B 'hickory-net':78C 'hickory-proto':70C 'key':33B 'name':37B,99C,105C,111C 'net':80C 'own':45B 'packag':21B 'produc':124C 'proto':72C 'record':7A,47B,57B,129C 'recursor':135C 'resolv':22B,62B,134C 'rrset':117C 'rrsig':93C 'rust':23B 'secur':121C 'sign':53B 'signatur':30B,39B,126C 'signer':103C 'unrel':9A,131C 'use':138C 'valid':28B,86C,90C,125C 'verifi':91C 'whatev':35B,98C 'without':107C 'zone':10A,36B,43B,54B,60B,114C,122C,132C","nicknames":[],"mitigations":[],"who_affected":"Applications built on the Hickory DNS Rust crates that perform DNSSEC validation, including resolvers, recursors and clients using DnssecDnsHandle, are exposed. Systems that do not use these crates for DNSSEC validation can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnssec","hickorydns","high","package","resolver","rust"],"campaign_type":null,"search_a":"'-123605':13A,16A '-2026':12A,15A 'accept':5A 'check':4A 'cve':11A,14A 'dns':2A 'dnssec':3A 'forg':6A 'hickori':1A 'record':7A 'unrel':9A 'zone':10A","search_b":"'accept':65B 'attack':49B 'authent':67B 'check':29B 'claim':40B 'client':64B 'control':51B 'dns':20B,25B 'dnssec':17B,27B 'forg':56B 'hickori':19B,24B 'hickory-dn':18B 'key':33B 'name':37B 'own':45B 'packag':21B 'record':47B,57B 'resolv':22B,62B 'rust':23B 'sign':53B 'signatur':30B,39B 'valid':28B 'whatev':35B 'zone':36B,43B,54B,60B","search_c":"'0.1':73C '0.25.0':75C '0.26.2':82C 'accept':140C 'alpha.3':76C 'appear':100C 'arbitrari':128C 'attack':118C 'authent':142C 'bypass':87C 'check':108C 'client':137C 'contain':83C,115C 'control':119C 'dns':69C 'dnskey':96C 'dnssec':85C 'dnssecdnshandl':139C 'field':106C 'hickori':68C,71C,79C 'hickory-net':78C 'hickory-proto':70C 'name':99C,105C,111C 'net':80C 'produc':124C 'proto':72C 'record':129C 'recursor':135C 'resolv':134C 'rrset':117C 'rrsig':93C 'secur':121C 'signatur':126C 'signer':103C 'unrel':131C 'use':138C 'valid':86C,90C,125C 'verifi':91C 'whatev':98C 'without':107C 'zone':114C,122C,132C","first_public_at":"2026-09-03T20:34:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123605","severity":null,"published_at":"2026-11-08T02:16:55+00:00","modified_at":"2026-11-08T02:16:55+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","fetched_at":"2026-11-08T02:21:14+00:00","note":null}],"documents":[{"id":99361,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj7c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-03T20:34:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99362,"url":"https://www.vulncheck.com/advisories/hickory-dns-through-0.25.0-alpha.3-dnssec-validation-bypass-via-rrsig-signer-s-name","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}