{"id":"CVE-2026-123607","kind":"vulnerability","aliases":["CVE-2026-123607"],"related":[],"title":"Hickory DNS: crafted NSEC3 response can exhaust memory or crash resolver","description":"Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXDomain responses with a cross-zone SOA record to panic debug builds or exhaust memory in release builds.","summary":"Hickory DNS hickory-proto and hickory-net contain an unbounded loop in DNSSEC NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the query name. An upstream attacker who returns a crafted NoData or NXDomain response with a cross-zone SOA record can crash debug builds or exhaust memory in release builds.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns","dnssec","hickory-dns","package","rust"],"not_affected_if":["no-dnssec-validation","other-dns-handle"],"how_to_check":"- Check the version of hickory-proto or hickory-net in your `Cargo.lock`, looking for `0.25.0-alpha.3` through `0.25.2` in hickory-proto or anything below `0.26.1` in hickory-net.\n- Check whether the resolver validates DNSSEC through `DnssecDnsHandle`.","fix":"- hickory-net: move to `0.26.1` or later\n- hickory-proto: move to a release newer than `0.25.2` (the sources do not name the exact fixed version for this branch)","status":"open","published_at":"2026-11-08T02:16:55+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","triaged_at":"2026-11-08T02:22:46+00:00","updated_at":"2026-11-08T02:22:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:22:46Z","model":"claude-haiku-5-5","output":{"fix":"- hickory-net: move to `0.26.1` or later\n- hickory-proto: move to a release newer than `0.25.2` (the sources do not name the exact fixed version for this branch)","reach":"network","title":"Hickory DNS: crafted NSEC3 response can exhaust memory or crash resolver","impact":"medium","summary":"Hickory DNS hickory-proto and hickory-net contain an unbounded loop in DNSSEC NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the query name. An upstream attacker who returns a crafted NoData or NXDomain response with a cross-zone SOA record can crash debug builds or exhaust memory in release builds.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","dns","hickory-dns","dnssec"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Resolver process crashes or runs out of memory from a crafted DNS response","analyst_note":"Confirm the fixed hickory-proto version for the 0.25 line and the exact DNSSEC configuration needed, using the vendor advisory linked from the NVD entry.","how_to_check":"- Check the version of hickory-proto or hickory-net in your `Cargo.lock`, looking for `0.25.0-alpha.3` through `0.25.2` in hickory-proto or anything below `0.26.1` in hickory-net.\n- Check whether the resolver validates DNSSEC through `DnssecDnsHandle`.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dnssec-validation","other-dns-handle"],"who_is_affected":"Applications built on the Hickory DNS Rust crates that perform DNSSEC validation through DnssecDnsHandle are exposed, since the attacker must answer as an upstream DNS server. Applications that do not use DNSSEC validation or that only use other DNS paths can skip it. The sources do not say whether release builds of common resolvers are affected beyond the memory exhaustion described.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000808,"input_tokens":4344,"output_tokens":748,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123607':14A,17A '-2026':13A,16A '0.25.0':91C '0.25.2':94C '0.26.1':100C 'alpha.3':92C 'ancestor':53B,121C 'attack':60B,126C 'build':79B,85B,143C,149C 'closest':42B,110C 'closest-enclos':41B,109C 'contain':34B,101C 'craft':3A,64B 'crash':10A,77B 'cross':72B,136C 'cross-zon':71B,135C 'cve':12A,15A 'debug':78B,142C 'dns':2A,18B,22B,26B,87C 'dnssec':19B,39B 'dnssecdnshandl':107C 'enclos':43B,111C 'exhaust':7A,81B,145C 'hickori':1A,21B,25B,28B,32B,86C,89C,97C 'hickory-dn':20B 'hickory-net':31B,96C 'hickory-proto':27B,88C 'loop':37B,104C 'memori':8A,82B,146C 'name':57B 'net':33B,98C 'nodata':65B,129C 'nsec3':4A,40B,108C 'nxdomain':67B,131C 'owner':49B,117C 'packag':23B 'panic':141C 'proof':44B,112C 'proto':29B,90C 'qname':124C 'queri':56B 'record':75B,139C 'releas':84B,148C 'resolv':11A 'respons':5A,68B,132C 'return':62B,128C 'rust':24B 'soa':48B,74B,116C,138C 'unbound':36B,103C 'upstream':59B,125C 'valid':45B,113C 'vulner':105C 'zone':73B,137C","nicknames":[],"mitigations":[],"who_affected":"Applications built on the Hickory DNS Rust crates that perform DNSSEC validation through DnssecDnsHandle are exposed, since the attacker must answer as an upstream DNS server. Applications that do not use DNSSEC validation or that only use other DNS paths can skip it. The sources do not say whether release builds of common resolvers are affected beyond the memory exhaustion described.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dns","dnssec","hickorydns","high","package","rust"],"campaign_type":null,"search_a":"'-123607':14A,17A '-2026':13A,16A 'craft':3A 'crash':10A 'cve':12A,15A 'dns':2A 'exhaust':7A 'hickori':1A 'memori':8A 'nsec3':4A 'resolv':11A 'respons':5A","search_b":"'ancestor':53B 'attack':60B 'build':79B,85B 'closest':42B 'closest-enclos':41B 'contain':34B 'craft':64B 'crash':77B 'cross':72B 'cross-zon':71B 'debug':78B 'dns':18B,22B,26B 'dnssec':19B,39B 'enclos':43B 'exhaust':81B 'hickori':21B,25B,28B,32B 'hickory-dn':20B 'hickory-net':31B 'hickory-proto':27B 'loop':37B 'memori':82B 'name':57B 'net':33B 'nodata':65B 'nsec3':40B 'nxdomain':67B 'owner':49B 'packag':23B 'proof':44B 'proto':29B 'queri':56B 'record':75B 'releas':84B 'respons':68B 'return':62B 'rust':24B 'soa':48B,74B 'unbound':36B 'upstream':59B 'valid':45B 'zone':73B","search_c":"'0.25.0':91C '0.25.2':94C '0.26.1':100C 'alpha.3':92C 'ancestor':121C 'attack':126C 'build':143C,149C 'closest':110C 'closest-enclos':109C 'contain':101C 'cross':136C 'cross-zon':135C 'debug':142C 'dns':87C 'dnssecdnshandl':107C 'enclos':111C 'exhaust':145C 'hickori':86C,89C,97C 'hickory-net':96C 'hickory-proto':88C 'loop':104C 'memori':146C 'net':98C 'nodata':129C 'nsec3':108C 'nxdomain':131C 'owner':117C 'panic':141C 'proof':112C 'proto':90C 'qname':124C 'record':139C 'releas':148C 'respons':132C 'return':128C 'soa':116C,138C 'unbound':103C 'upstream':125C 'valid':113C 'vulner':105C 'zone':137C","first_public_at":"2026-05-01T13:58:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123607","severity":null,"published_at":"2026-11-08T02:16:55+00:00","modified_at":"2026-11-08T02:16:55+00:00","first_seen_at":"2026-11-08T02:21:14+00:00","fetched_at":"2026-11-08T02:21:14+00:00","note":null}],"documents":[{"id":99365,"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-05-01T13:58:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99366,"url":"https://www.vulncheck.com/advisories/hickory-dns-nsec3-closest-encloser-proof-unbounded-loop-denial-of-service","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}