DEBIAN-CVE-2026-123580: High severity debian/rust-hickory-net vulnerability

Q: What does an attacker need to exploit this issue?

An attacker needs to be able to supply NSEC3 records from a different DNS zone whose hashed label matches the label used in the target proof. No authentication or user interaction is required according to the supplied severity vector.

Q: What is the impact of a successful exploit?

A successful exploit can forge DNSSEC proofs that a DNS name does not exist. The provided severity vector indicates integrity impact, with no stated confidentiality or availability impact.

Q: Which Debian packages are identified as affected?

The affected software listed is debian/rust-hickory-proto and debian/rust-hickory-net. The issue affects hickory-net from 0.26.0-beta.1 before 0.26.2, and hickory-proto through 0.26.0-alpha.1.

Published Nov 8, 2026

Updated

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to be able to supply NSEC3 records from a different DNS zone whose hashed label matches the label used in the target proof. No authentication or user interaction is required according to the supplied severity vector.

What is the impact of a successful exploit?

A successful exploit can forge DNSSEC proofs that a DNS name does not exist. The provided severity vector indicates integrity impact, with no stated confidentiality or availability impact.

Which Debian packages are identified as affected?

The affected software listed is debian/rust-hickory-proto and debian/rust-hickory-net. The issue affects hickory-net from 0.26.0-beta.1 before 0.26.2, and hickory-proto through 0.26.0-alpha.1.

DEBIAN-CVE-2026-123580: High severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the impact of a successful exploit?

Which Debian packages are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the impact of a successful exploit?

Which Debian packages are identified as affected?