DEBIAN-CVE-2026-123578: Low severity debian/rust-hickory-net vulnerability

Q: Who is exposed to this issue?

Systems using the affected Debian rust-hickory-proto or rust-hickory-net packages are exposed when they issue DNS queries over UDP and an attacker can inject spoofed UDP responses.

Q: What does an attacker need to exploit the weakness?

The attacker must be able to inject a spoofed UDP DNS response. They can use a response with an empty question section (QDCOUNT=0) to bypass question matching and case-randomization checks.

Q: What is the practical security impact?

The flaw weakens defenses intended to prevent DNS spoofing, allowing spoofed responses to evade the affected validation checks. The stated impact is integrity-only; no confidentiality or availability impact is identified.

Q: Which versions are affected?

Affected versions are hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2.

Published Nov 8, 2026

Updated

Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section matches the query when the response has an empty question section (QDCOUNT=0), and also skip the case-randomization check. Remote attackers able to inject spoofed UDP responses can send QDCOUNT=0 responses to bypass these checks, weakening defenses against DNS spoofing.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using the affected Debian rust-hickory-proto or rust-hickory-net packages are exposed when they issue DNS queries over UDP and an attacker can inject spoofed UDP responses.

What does an attacker need to exploit the weakness?

The attacker must be able to inject a spoofed UDP DNS response. They can use a response with an empty question section (QDCOUNT=0) to bypass question matching and case-randomization checks.

What is the practical security impact?

The flaw weakens defenses intended to prevent DNS spoofing, allowing spoofed responses to evade the affected validation checks. The stated impact is integrity-only; no confidentiality or availability impact is identified.

Which versions are affected?

Affected versions are hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2.

DEBIAN-CVE-2026-123578: Low severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the weakness?

What is the practical security impact?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the weakness?

What is the practical security impact?

Which versions are affected?