CVE-2026-123587: Security vulnerability

Published Nov 8, 2026

Updated

The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attacker must be able to supply DNS responses to the affected resolver or client. They combine a genuine NSEC record and its RRSIG with a crafted SOA record that fails validation.

What can an attacker achieve if exploitation succeeds?

An attacker can forge proof that any requested RRset does not exist. This can cause DNSSEC validation to accept false nonexistence results.

Which versions are affected?

The issue affects the Hickory DNS hickory-net crate from version 0.26.0 before 0.26.2. Upgrading to 0.26.2 or later removes the affected version range.

CVE-2026-123587: Security vulnerability

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What can an attacker achieve if exploitation succeeds?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What can an attacker achieve if exploitation succeeds?

Which versions are affected?