CVE-2026-123581: Security vulnerability

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this flaw?

Deployments using Hickory DNS hickory-proto through 0.26.0-alpha.1 or hickory-net from 0.26.0-beta.1 before 0.26.2 are affected when they perform DNSSEC validation.

What must an attacker provide to exploit the issue?

The attacker must be able to supply a DNS response containing a validly signed RRset that is unrelated to the query. The vulnerable validator can then treat the response as a positive answer even when the requested record is absent.

How can I determine whether my deployment is vulnerable?

Check the versions of hickory-proto and hickory-net in use and whether DNSSEC validation is enabled. hickory-proto versions through 0.26.0-alpha.1 and hickory-net versions starting at 0.26.0-beta.1 but before 0.26.2 are within the affected ranges.

CVE-2026-123581: Security vulnerability

Event History

Frequently Asked Questions

Which deployments are exposed to this flaw?

What must an attacker provide to exploit the issue?

How can I determine whether my deployment is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this flaw?

What must an attacker provide to exploit the issue?

How can I determine whether my deployment is vulnerable?