Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-123580

Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

hickory-dns hickory-dns

Default version status: unaffected

  • 0.26.0-beta.1 to < 0.26.2affected
  • 0.26.2unaffected
pkg:cargo/hickory-net

hickory-dns hickory-dns

Default version status: unaffected

  • 0 to ≤ 0.26.0-alpha.1affected
pkg:cargo/hickory-proto

References