DEBIAN-CVE-2026-123600: Medium severity debian/rust-hickory-net vulnerability

Q: Who is realistically exposed to this flaw?

Deployments using the affected Hickory DNS components and performing DNSSEC validation are exposed when they query zone-apex record types. An on-path attacker or a malicious authoritative DNS server can exploit the validation behavior.

Q: What does an attacker need to do to exploit it?

The attacker must be able to provide a DNS response, either by being on path or controlling a malicious authoritative server. They can replay a validly signed non-apex NSEC3 record together with the zone's signed SOA to create an authenticated negative response for an apex RRtype.

Q: What is the impact of a successful attack?

A successful attack can cause the resolver to accept a forged NODATA response as DNSSEC-authenticated, with the AD bit set. The denial can be cached for the negative-cache TTL, affecting availability of the requested apex record type and potentially its integrity.

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this flaw?

Deployments using the affected Hickory DNS components and performing DNSSEC validation are exposed when they query zone-apex record types. An on-path attacker or a malicious authoritative DNS server can exploit the validation behavior.

What does an attacker need to do to exploit it?

The attacker must be able to provide a DNS response, either by being on path or controlling a malicious authoritative server. They can replay a validly signed non-apex NSEC3 record together with the zone's signed SOA to create an authenticated negative response for an apex RRtype.

What is the impact of a successful attack?

A successful attack can cause the resolver to accept a forged NODATA response as DNSSEC-authenticated, with the AD bit set. The denial can be cached for the negative-cache TTL, affecting availability of the requested apex record type and potentially its integrity.

DEBIAN-CVE-2026-123600: Medium severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this flaw?

What does an attacker need to do to exploit it?

What is the impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this flaw?

What does an attacker need to do to exploit it?

What is the impact of a successful attack?