DEBIAN-CVE-2026-123599: Low severity debian/rust-hickory-net vulnerability

Q: What access does an attacker need to exploit this issue?

An attacker must be able to supply DNS responses to the vulnerable resolver or application. No privileges or user interaction are required.

Q: What could an attacker do after bypassing validation?

The attacker can use forged CH or HS class records, including DS records, to authenticate an arbitrary DNSKEY and forge responses for child zones.

Q: Which component versions are affected?

Hickory DNS hickory-proto versions before 0.26.0-beta.1 and hickory-net versions before 0.26.2 are affected. The listed Debian packages are rust-hickory-proto and rust-hickory-net.

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verifyrrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker must be able to supply DNS responses to the vulnerable resolver or application. No privileges or user interaction are required.

What could an attacker do after bypassing validation?

The attacker can use forged CH or HS class records, including DS records, to authenticate an arbitrary DNSKEY and forge responses for child zones.

Which component versions are affected?

Hickory DNS hickory-proto versions before 0.26.0-beta.1 and hickory-net versions before 0.26.2 are affected. The listed Debian packages are rust-hickory-proto and rust-hickory-net.

DEBIAN-CVE-2026-123599: Low severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What could an attacker do after bypassing validation?

Which component versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What could an attacker do after bypassing validation?

Which component versions are affected?