DEBIAN-CVE-2026-123601: Medium severity debian/rust-hickory-net vulnerability

Q: Who is exposed to this issue?

Deployments using the affected Debian rust-hickory-proto or rust-hickory-net packages are exposed when they perform DNSSEC validation and can be targeted with injected DNS responses.

Q: What does an attacker need to exploit it?

An attacker must be able to inject DNS responses and replay the final NSEC3 record in a zone's hash ring together with its RRSIG. No authentication or user interaction is required according to the supplied vector.

Q: What is the impact of a successful exploit?

The attacker can forge DNSSEC-validated negative responses that deny legitimate DNS names. The supplied severity vector indicates integrity impact and high availability impact, with no confidentiality impact.

Q: Which versions are affected?

hickory-proto versions 0.25.0 through 0.26.0-alpha.1 are affected. For hickory-net, 0.26.0-beta.1 before 0.26.2 is affected.

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of findcoveringrecord() in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to inject DNS responses can replay that NSEC3 record and its RRSIG to forge DNSSEC-validated negative responses denying legitimate names.

Affected Software

3 affected componentsFixes available

debian/rust-hickory-net<0.26.3-1

0.26.3-1

debian/rust-hickory-proto*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rust-hickory-net to a version that resolves this vulnerability.
Fixed in 0.26.3-1

Event History

Nov 8, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Deployments using the affected Debian rust-hickory-proto or rust-hickory-net packages are exposed when they perform DNSSEC validation and can be targeted with injected DNS responses.

What does an attacker need to exploit it?

An attacker must be able to inject DNS responses and replay the final NSEC3 record in a zone's hash ring together with its RRSIG. No authentication or user interaction is required according to the supplied vector.

What is the impact of a successful exploit?

The attacker can forge DNSSEC-validated negative responses that deny legitimate DNS names. The supplied severity vector indicates integrity impact and high availability impact, with no confidentiality impact.

Which versions are affected?

hickory-proto versions 0.25.0 through 0.26.0-alpha.1 are affected. For hickory-net, 0.26.0-beta.1 before 0.26.2 is affected.

DEBIAN-CVE-2026-123601: Medium severity debian/rust-hickory-net vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of a successful exploit?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of a successful exploit?

Which versions are affected?