DEBIAN-CVE-2026-123593: Medium severity debian/rust-hickory-net vulnerability

Q: What does an attacker need to exploit this issue?

The attacker must be able to spoof or control DNS name server responses. No privileges or user interaction are required.

Q: What is the practical impact of a successful attack?

An attacker can replace a secure zone's DNSKEY RRset with the root zone's keys, causing that RRset to be accepted without RRSIG verification. This can affect integrity and availability.

Q: Can the effect persist after the attacker stops controlling responses?

Yes. The attacker can use a large TTL on the substituted DNSKEY RRset, allowing the malicious key set to remain cached.

Q: Which upstream versions are described as affected?

hickory-net is affected from 0.26.0-beta.1 before 0.26.2. hickory-proto is affected from 0.24.0 through 0.26.0-alpha.1.

Published Nov 8, 2026

Updated

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker must be able to spoof or control DNS name server responses. No privileges or user interaction are required.

What is the practical impact of a successful attack?

An attacker can replace a secure zone's DNSKEY RRset with the root zone's keys, causing that RRset to be accepted without RRSIG verification. This can affect integrity and availability.

Can the effect persist after the attacker stops controlling responses?

Yes. The attacker can use a large TTL on the substituted DNSKEY RRset, allowing the malicious key set to remain cached.

Which upstream versions are described as affected?

hickory-net is affected from 0.26.0-beta.1 before 0.26.2. hickory-proto is affected from 0.24.0 through 0.26.0-alpha.1.

DEBIAN-CVE-2026-123593: Medium severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the practical impact of a successful attack?

Can the effect persist after the attacker stops controlling responses?

Which upstream versions are described as affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the practical impact of a successful attack?

Can the effect persist after the attacker stops controlling responses?

Which upstream versions are described as affected?