---
id: "CVE-2026-123605"
page: "https://infrastack.ai/live/CVE-2026-123605"
kind: "vulnerability"
aliases: ["CVE-2026-123605"]
title: "Hickory DNS: DNSSEC check accepts forged records from unrelated zones"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dnssec", "hickory-dns", "package", "resolver", "rust"]
not_affected_if: ["no-dnssec-validation", "not-using-dnssecdnshandle"]
published_at: "2026-11-08T02:16:55+00:00"
first_seen_at: "2026-11-08T02:21:14+00:00"
updated_at: "2026-11-08T02:22:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123605", "first_seen_at": "2026-11-08T02:21:14+00:00"}]
exploit_sources: []
---

# Hickory DNS: DNSSEC check accepts forged records from unrelated zones

Link for people: https://infrastack.ai/live/CVE-2026-123605 (this .md is for agents)

Hickory DNS's DNSSEC validator checks signatures against the key of whatever zone name the signature claims, not the zone that owns the records. An attacker who controls any signed zone can forge records for other zones that resolvers and clients accept as authenticated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the hickory-proto and hickory-net versions in your `Cargo.lock`; affected are hickory-proto `0.1` through `0.25.0-alpha.3` and hickory-net before `0.26.2`.
- Look for uses of `DnssecDnsHandle` in your code.

## Fix

- hickory-net: move to `0.26.2` or later (per the NVD description).
- hickory-proto: the NVD description gives the affected range only; the fixed version is unknown.

## Timeline

- 2026-11-08T02:21:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123605

## Documents

- [advisory] Vendor advisory: github.com https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj7c
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/hickory-dns-through-0.25.0-alpha.3-dnssec-validation-bypass-via-rrsig-signer-s-name

## From the sources

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_