DEBIAN-CVE-2026-123597: Low severity debian/rust-hickory-net vulnerability

Q: What must an attacker be able to do to exploit this issue?

The attacker must be able to induce a SERVFAIL, REFUSED, or timeout response to a DS sub-query for a child zone. This causes the DNSSEC validator to cache the transient error as a Bogus verdict.

Q: What is the practical impact on affected DNSSEC validation?

The validator returns SERVFAIL for all names under the affected child zone until the cached entry's TTL expires. The stated impact is availability disruption; no confidentiality or integrity impact is described.

Q: Which Debian packages are affected?

The affected Debian packages are rust-hickory-proto and rust-hickory-net. The issue applies to hickory-proto versions 0.25.0-alpha.1 through 0.26.0-alpha.1, and to hickory-net versions before 0.26.2.

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attacker must be able to induce a SERVFAIL, REFUSED, or timeout response to a DS sub-query for a child zone. This causes the DNSSEC validator to cache the transient error as a Bogus verdict.

What is the practical impact on affected DNSSEC validation?

The validator returns SERVFAIL for all names under the affected child zone until the cached entry's TTL expires. The stated impact is availability disruption; no confidentiality or integrity impact is described.

Which Debian packages are affected?

The affected Debian packages are rust-hickory-proto and rust-hickory-net. The issue applies to hickory-proto versions 0.25.0-alpha.1 through 0.26.0-alpha.1, and to hickory-net versions before 0.26.2.

DEBIAN-CVE-2026-123597: Low severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the practical impact on affected DNSSEC validation?

Which Debian packages are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the practical impact on affected DNSSEC validation?

Which Debian packages are affected?