CVE-2026-123582: Security vulnerability

Published Nov 8, 2026

Updated

The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the SOA record passed DNSSEC validation when assembling NXDOMAIN or NODATA responses. An attacker able to supply forged DNS responses can have a forged SOA record returned to clients with the AD bit set, misleading clients that rely on the server's DNSSEC validation.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-server to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected deployments are validating recursive resolvers and validating forwarders using hickory-server versions from 0.25.0 before 0.26.2. The issue applies when the server assembles NXDOMAIN or NODATA responses.

What does an attacker need to exploit this issue?

An attacker must be able to supply forged DNS responses. They can cause a forged SOA record to be returned to clients with the AD bit set.

What is the impact on clients?

Clients that rely on the server's DNSSEC validation can be misled into treating the forged SOA record as validated because it is returned with the AD bit set.

How can I determine whether a resolver may be affected?

Check whether the deployment runs hickory-server 0.25.0 through versions before 0.26.2 and operates as a validating recursive resolver or validating forwarder. Also determine whether downstream clients rely on the AD bit as evidence of DNSSEC validation.

CVE-2026-123582: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact on clients?

How can I determine whether a resolver may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact on clients?

How can I determine whether a resolver may be affected?