DEBIAN-CVE-2026-123582: Low severity debian/rust-hickory-server vulnerability

Q: Which deployments are exposed to this issue?

Deployments using Hickory DNS hickory-server as a validating recursive resolver or validating forwarder are affected in versions from 0.25.0 before 0.26.2. The issue concerns NXDOMAIN and NODATA responses assembled by those validating modes.

Q: What does an attacker need to exploit it?

An attacker must be able to supply forged DNS responses to the resolver or forwarder. Successful exploitation can cause it to return a forged SOA record with the AD bit set.

Q: What is the practical impact on clients?

Clients that rely on the server's DNSSEC validation can be misled into treating the forged SOA record as DNSSEC-authenticated. The stated impact is integrity-only; confidentiality and availability are not affected.

Q: How can this be remediated?

Upgrade hickory-server to version 0.26.2 or later. The provided data does not identify an alternative mitigation when an upgrade cannot be applied immediately.

Published Nov 8, 2026

Updated

The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the SOA record passed DNSSEC validation when assembling NXDOMAIN or NODATA responses. An attacker able to supply forged DNS responses can have a forged SOA record returned to clients with the AD bit set, misleading clients that rely on the server's DNSSEC validation.

Affected Software

2 affected componentsFixes available

debian/rust-hickory-server*

debian/rust-hickory-server<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-server to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade hickory-server to a version that resolves this vulnerability.
Fixed in 0.26.2

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Hickory DNS hickory-server as a validating recursive resolver or validating forwarder are affected in versions from 0.25.0 before 0.26.2. The issue concerns NXDOMAIN and NODATA responses assembled by those validating modes.

What does an attacker need to exploit it?

An attacker must be able to supply forged DNS responses to the resolver or forwarder. Successful exploitation can cause it to return a forged SOA record with the AD bit set.

What is the practical impact on clients?

Clients that rely on the server's DNSSEC validation can be misled into treating the forged SOA record as DNSSEC-authenticated. The stated impact is integrity-only; confidentiality and availability are not affected.

How can this be remediated?

Upgrade hickory-server to version 0.26.2 or later. The provided data does not identify an alternative mitigation when an upgrade cannot be applied immediately.

DEBIAN-CVE-2026-123582: Low severity debian/rust-hickory-server vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact on clients?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact on clients?

How can this be remediated?