DEBIAN-CVE-2026-123596: High severity debian/rust-hickory-net vulnerability

Q: Which deployments are exposed to this issue?

Deployments using the affected Hickory components as a validating DNS recursor are exposed. The vulnerable packages are debian/rust-hickory-proto and debian/rust-hickory-net; the issue concerns DNSSEC validation in the recursor's NSEC handler.

Q: What must an attacker be able to do to exploit it?

An attacker must be able to deliver a forged NXDOMAIN response containing genuinely signed parent NSEC records. The described attack paths are an on-path position, control of a rogue parent nameserver, or winning a DNS source-port and transaction-ID race.

Q: What is the practical impact of a successful attack?

A successful forged response can cause the resolver to treat existing child-zone names as nonexistent. This authenticated denial result is cached for the negative TTL, making affected names unavailable through that resolver for that period.

Q: Which versions are affected or fixed?

Hickory-proto is affected through 0.26.0-alpha.1. Hickory-net is affected before 0.26.2, so 0.26.2 is the version identified by the provided data as outside that affected range.

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. An on-path attacker, rogue parent nameserver, or attacker winning a port and TXID race can deliver one forged NXDOMAIN response built from genuinely signed parent NSEC records, causing authenticated denial of existing child-zone names cached for the negative TTL.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the affected Hickory components as a validating DNS recursor are exposed. The vulnerable packages are debian/rust-hickory-proto and debian/rust-hickory-net; the issue concerns DNSSEC validation in the recursor's NSEC handler.

What must an attacker be able to do to exploit it?

An attacker must be able to deliver a forged NXDOMAIN response containing genuinely signed parent NSEC records. The described attack paths are an on-path position, control of a rogue parent nameserver, or winning a DNS source-port and transaction-ID race.

What is the practical impact of a successful attack?

A successful forged response can cause the resolver to treat existing child-zone names as nonexistent. This authenticated denial result is cached for the negative TTL, making affected names unavailable through that resolver for that period.

Which versions are affected or fixed?

Hickory-proto is affected through 0.26.0-alpha.1. Hickory-net is affected before 0.26.2, so 0.26.2 is the version identified by the provided data as outside that affected range.

DEBIAN-CVE-2026-123596: High severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

What is the practical impact of a successful attack?

Which versions are affected or fixed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

What is the practical impact of a successful attack?

Which versions are affected or fixed?