GHSA-588m-chg6-8jqj: Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery

Published Nov 8, 2026

Updated

Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of findcoveringrecord() in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to inject DNS responses can replay that NSEC3 record and its RRSIG to forge DNSSEC-validated negative responses denying legitimate names.

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments using the affected hickory-proto or hickory-net versions and relying on DNSSEC validation of NSEC3 negative responses are exposed. An attacker must be able to inject DNS responses seen by the resolver or client.

What does an attacker need to forge a negative DNSSEC response?

The attacker can replay the last NSEC3 record in a zone's hash ring together with its RRSIG. Due to the incorrect wrap-around comparison, that record is treated as covering hashes other than its owner and can be used to deny legitimate names.

Which versions are affected?

The affected ranges are hickory-proto 0.25.0 through 0.26.0-alpha.1, and hickory-net 0.26.0-beta.1 before 0.26.2. The provided data identifies 0.26.2 as the fixed boundary for hickory-net.

GHSA-588m-chg6-8jqj: Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to forge a negative DNSSEC response?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to forge a negative DNSSEC response?

Which versions are affected?