DEBIAN-CVE-2026-123591: Medium severity debian/rust-hickory-net vulnerability
Published Nov 8, 2026
·Updated
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 fail to verify, per RFC 6840 §4.4, that an NSEC or NSEC3 record denying a DS RRset also proves the delegation's NS record exists. Attackers can reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records.
Affected Software
3 affected componentsFixes available
debian/rust-hickory-net<0.26.3-1
0.26.3-1
debian/rust-hickory-proto*
debian/rust-hickory-proto*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-hickory-netto a version that resolves this vulnerability.Fixed in 0.26.3-1
Event History
Nov 8, 2026
CVE Published
via OSV·02:16 AM
Data Sourced
via OSV·02:16 AM
DescriptionSeverityAffected Software