DEBIAN-CVE-2026-123590: Medium severity debian/rust-hickory-net vulnerability

Q: What must an attacker be able to do to exploit this issue?

The attacker must be able to supply DNS responses to the vulnerable Hickory DNS client or resolver. Exploitation relies on mixing validly signed records with forged NSEC or NSEC3 records sharing the same owner name in the authority section.

Q: What security effect can exploitation have?

An attacker can forge DNSSEC nonexistence proofs. The reported impact is limited to integrity and availability; confidentiality is not affected.

Q: Which Debian packages are affected?

The affected Debian packages are rust-hickory-proto and rust-hickory-net. The issue affects hickory-net versions before 0.26.2 in the stated 0.26.0-beta.1 line, and hickory-proto through 0.26.0-alpha.1.

Published Nov 8, 2026

Updated

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attacker must be able to supply DNS responses to the vulnerable Hickory DNS client or resolver. Exploitation relies on mixing validly signed records with forged NSEC or NSEC3 records sharing the same owner name in the authority section.

What security effect can exploitation have?

An attacker can forge DNSSEC nonexistence proofs. The reported impact is limited to integrity and availability; confidentiality is not affected.

Which Debian packages are affected?

The affected Debian packages are rust-hickory-proto and rust-hickory-net. The issue affects hickory-net versions before 0.26.2 in the stated 0.26.0-beta.1 line, and hickory-proto through 0.26.0-alpha.1.

DEBIAN-CVE-2026-123590: Medium severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What security effect can exploitation have?

Which Debian packages are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What security effect can exploitation have?

Which Debian packages are affected?