CVE-2026-123607 · Package
NO FIX YET · SEE WHAT TO DO
Hickory DNS hickory-proto and hickory-net contain an unbounded loop in DNSSEC NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the query name. An upstream attacker who returns a crafted NoData or NXDomain response with a cross-zone SOA record can crash debug builds or exhaust memory in release builds.
first public May 1, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications built on the Hickory DNS Rust crates that perform DNSSEC validation through DnssecDnsHandle are exposed, since the attacker must answer as an upstream DNS server. Applications that do not use DNSSEC validation or that only use other DNS paths can skip it. The sources do not say whether release builds of common resolvers are affected beyond the memory exhaustion described.
Not affected if no-dnssec-validation, other-dns-handle
Who cares dns, dnssec, hickory-dns, rust
Cargo.lock, looking for 0.25.0-alpha.3 through 0.25.2 in hickory-proto or anything below 0.26.1 in hickory-net.DnssecDnsHandle.0.26.1 or laterHickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXDomain responses with a cross-zone SOA record to panic debug builds or exhaust memory in release builds.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
0.25.2