CVE-2026-123590: Security vulnerability

Published Nov 8, 2026

Updated

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which releases require remediation?

Affected releases are hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1.

What must an attacker be able to do to exploit this issue?

The attacker must be able to supply DNS responses. They can combine validly signed same-name records with bogus NSEC or NSEC3 records in the authority section.

What is the security impact of successful exploitation?

An attacker can forge DNSSEC nonexistence proofs by using bogus same-name NSEC or NSEC3 records of different types when another record for that owner name passes signature validation.

CVE-2026-123590: Security vulnerability

Event History

Frequently Asked Questions

Which releases require remediation?

What must an attacker be able to do to exploit this issue?

What is the security impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which releases require remediation?

What must an attacker be able to do to exploit this issue?

What is the security impact of successful exploitation?