DEBIAN-CVE-2026-123594: Medium severity debian/rust-hickory-net vulnerability

Q: Who can exploit this issue?

An on-path attacker who can intercept or modify DNS traffic can exploit it. The attack relies on changing the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN.

Q: What is the practical impact on a vulnerable validator?

A vulnerable validator can accept a forged proof that a queried DNS name does not exist. This can cause forged nonexistence results for names that actually exist as empty non-terminals.

Q: Which Debian packages are identified as affected?

The affected Debian package names are rust-hickory-proto and rust-hickory-net. The provided data identifies hickory-proto through 0.26.0-alpha.1 and hickory-net versions before 0.26.2 as affected.

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually proves the name exists as an empty non-terminal. On-path attackers can flip the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN, causing validators to accept forged nonexistence of the name.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An on-path attacker who can intercept or modify DNS traffic can exploit it. The attack relies on changing the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN.

What is the practical impact on a vulnerable validator?

A vulnerable validator can accept a forged proof that a queried DNS name does not exist. This can cause forged nonexistence results for names that actually exist as empty non-terminals.

Which Debian packages are identified as affected?

The affected Debian package names are rust-hickory-proto and rust-hickory-net. The provided data identifies hickory-proto through 0.26.0-alpha.1 and hickory-net versions before 0.26.2 as affected.

DEBIAN-CVE-2026-123594: Medium severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact on a vulnerable validator?

Which Debian packages are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact on a vulnerable validator?

Which Debian packages are identified as affected?