DEBIAN-CVE-2026-123595: High severity debian/rust-hickory-net vulnerability

Q: Which deployments are exposed to this issue?

Deployments using the affected Hickory DNS hickory-proto or hickory-net versions in a validating recursive resolver are exposed. The flaw is specifically in the validating recursor's NSEC3 handler.

Q: What does an attacker need to exploit the flaw?

An attacker needs to deliver a DNS response constructed from genuinely signed parent NSEC3 records. No user interaction is required, and the attack can be performed over the network by an attacker with the stated low-privilege access.

Q: What is the practical impact of a successful attack?

The resolver can cache NXDOMAIN or NODATA responses with the AD bit set for names that actually exist at or below a zone cut. This can deny resolution of those names while the incorrect cache entry is used.

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the affected Hickory DNS hickory-proto or hickory-net versions in a validating recursive resolver are exposed. The flaw is specifically in the validating recursor's NSEC3 handler.

What does an attacker need to exploit the flaw?

An attacker needs to deliver a DNS response constructed from genuinely signed parent NSEC3 records. No user interaction is required, and the attack can be performed over the network by an attacker with the stated low-privilege access.

What is the practical impact of a successful attack?

The resolver can cache NXDOMAIN or NODATA responses with the AD bit set for names that actually exist at or below a zone cut. This can deny resolution of those names while the incorrect cache entry is used.

DEBIAN-CVE-2026-123595: High severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the flaw?

What is the practical impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the flaw?

What is the practical impact of a successful attack?