DEBIAN-CVE-2026-123598: Low severity debian/rust-hickory-net vulnerability

Q: What must an attacker be able to do to exploit this issue?

An attacker must be able to spoof an authoritative DNS response to the validating recursor. The spoofed response needs an invalid DNSSEC signature and a long record TTL.

Q: What is the practical impact of a successful attack?

The resolver can cache a DNSSEC-bogus result using the attacker-supplied TTL, capped at 24 hours. This can keep the bogus result in cache for up to a day and cause an availability impact.

Q: Which Debian-packaged components are affected?

The affected Debian packages are rust-hickory-recursor, rust-hickory-resolver, and rust-hickory-net. The described behavior affects specified Hickory recursor, resolver, and network library release ranges.

Published Nov 8, 2026

Updated

The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.

Affected Software

5 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-recursor*

debian/rust-hickory-resolver*

debian/rust-hickory-resolver<0.26.3-1

0.26.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1
Upgrade
Upgrade debian/rust-hickory-resolver to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

An attacker must be able to spoof an authoritative DNS response to the validating recursor. The spoofed response needs an invalid DNSSEC signature and a long record TTL.

What is the practical impact of a successful attack?

The resolver can cache a DNSSEC-bogus result using the attacker-supplied TTL, capped at 24 hours. This can keep the bogus result in cache for up to a day and cause an availability impact.

Which Debian-packaged components are affected?

The affected Debian packages are rust-hickory-recursor, rust-hickory-resolver, and rust-hickory-net. The described behavior affects specified Hickory recursor, resolver, and network library release ranges.

DEBIAN-CVE-2026-123598: Low severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the practical impact of a successful attack?

Which Debian-packaged components are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the practical impact of a successful attack?

Which Debian-packaged components are affected?