DEBIAN-CVE-2026-123581: Medium severity debian/rust-hickory-net vulnerability

Q: What must an attacker be able to do to exploit this flaw?

An attacker must be able to supply DNS responses containing signed but unrelated RRsets. The vulnerable DNSSEC validation logic can then treat a response with no record matching the query as a positive answer.

Q: What is the practical impact of successful exploitation?

DNS responses that should be handled as no-data responses can be incorrectly validated as positive answers. The provided severity vector indicates an integrity impact, with no stated confidentiality or availability impact.

Q: Which Debian packages are identified as affected?

The affected Debian packages are rust-hickory-proto and rust-hickory-net. The issue affects hickory-proto through 0.26.0-alpha.1 and hickory-net versions before 0.26.2, as stated in the advisory.

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this flaw?

An attacker must be able to supply DNS responses containing signed but unrelated RRsets. The vulnerable DNSSEC validation logic can then treat a response with no record matching the query as a positive answer.

What is the practical impact of successful exploitation?

DNS responses that should be handled as no-data responses can be incorrectly validated as positive answers. The provided severity vector indicates an integrity impact, with no stated confidentiality or availability impact.

Which Debian packages are identified as affected?

The affected Debian packages are rust-hickory-proto and rust-hickory-net. The issue affects hickory-proto through 0.26.0-alpha.1 and hickory-net versions before 0.26.2, as stated in the advisory.

DEBIAN-CVE-2026-123581: Medium severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this flaw?

What is the practical impact of successful exploitation?

Which Debian packages are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this flaw?

What is the practical impact of successful exploitation?

Which Debian packages are identified as affected?