DEBIAN-CVE-2026-123579: Low severity debian/rust-hickory-net vulnerability

Q: What conditions are required for exploitation?

The affected resolver must perform DNSSEC validation for a query that should produce NODATA in a zone containing wildcard records. An attacker must be able to supply a bogus positive response that combines an NSEC3 record matching the queried name with a signed wildcard record.

Q: What is the impact if validation accepts the forged response?

The vulnerability can cause DNSSEC validation to accept a bogus positive DNS response where NODATA should have been returned. The reported impact is integrity-only; confidentiality and availability are not affected.

Q: Which components and versions are affected?

Hickory DNS hickory-net versions from 0.26.0-beta.1 before 0.26.2 are affected. Hickory-proto is affected through 0.26.0-alpha.1.

Published Nov 8, 2026

Updated

DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

The affected resolver must perform DNSSEC validation for a query that should produce NODATA in a zone containing wildcard records. An attacker must be able to supply a bogus positive response that combines an NSEC3 record matching the queried name with a signed wildcard record.

What is the impact if validation accepts the forged response?

The vulnerability can cause DNSSEC validation to accept a bogus positive DNS response where NODATA should have been returned. The reported impact is integrity-only; confidentiality and availability are not affected.

Which components and versions are affected?

Hickory DNS hickory-net versions from 0.26.0-beta.1 before 0.26.2 are affected. Hickory-proto is affected through 0.26.0-alpha.1.

DEBIAN-CVE-2026-123579: Low severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What is the impact if validation accepts the forged response?

Which components and versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the impact if validation accepts the forged response?

Which components and versions are affected?