DEBIAN-CVE-2026-123592: Medium severity debian/rust-hickory-net vulnerability

Q: Which deployments are exposed?

Deployments using the hickory-net crate in Hickory DNS versions from 0.26.0-beta.1 through versions before 0.26.2 are affected where DNSSEC validation results can be cached and reused.

Q: What capabilities does an attacker need?

The attacker must control an unsigned delegation whose name differs from a signed target only in dot positions. No authentication or user interaction is required, but the attack has high complexity.

Q: What is the available remediation?

Upgrade Hickory DNS and hickory-net to version 0.26.2 or later. The affected range is stated as versions before 0.26.2.

Published Nov 8, 2026

Updated

The hickory-net crate in Hickory DNS 0.26.0-beta.1 before 0.26.2 allows DNSSEC validation bypass because Name's Hash ignores label lengths and ValidationCacheKey compares only that hash. An attacker controlling an unsigned delegation whose name differs from a signed target only in dot positions can prime an Insecure verdict, causing forged answers for the target to skip signature verification instead of returning SERVFAIL.

Affected Software

1 affected componentFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments using the hickory-net crate in Hickory DNS versions from 0.26.0-beta.1 through versions before 0.26.2 are affected where DNSSEC validation results can be cached and reused.

What capabilities does an attacker need?

The attacker must control an unsigned delegation whose name differs from a signed target only in dot positions. No authentication or user interaction is required, but the attack has high complexity.

What is the available remediation?

Upgrade Hickory DNS and hickory-net to version 0.26.2 or later. The affected range is stated as versions before 0.26.2.

DEBIAN-CVE-2026-123592: Medium severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What capabilities does an attacker need?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What capabilities does an attacker need?

What is the available remediation?