CVE-2026-123607: Security vulnerability

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXDomain responses with a cross-zone SOA record to panic debug builds or exhaust memory in release builds.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.1

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using hickory-proto versions 0.25.0-alpha.3 through 0.25.2 or hickory-net versions before 0.26.1 are affected when they perform DNSSEC NSEC3 closest-encloser proof validation.

What does an attacker need to do to trigger the vulnerability?

An upstream attacker must be able to return a NoData or NXDomain DNS response containing a cross-zone SOA record, where the SOA owner is not an ancestor of the queried name.

What is the operational impact in debug and release builds?

Malicious responses can panic debug builds. In release builds, the unbounded loop can exhaust memory and cause a denial of service.

CVE-2026-123607: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

What is the operational impact in debug and release builds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

What is the operational impact in debug and release builds?