GHSA-7php-9j59-g3ch: Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks

Published Nov 8, 2026

Updated

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 fail to verify, per RFC 6840 §4.4, that an NSEC or NSEC3 record denying a DS RRset also proves the delegation's NS record exists. Attackers can reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records.

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this validation bypass?

Deployments using hickory-net from 0.26.0-beta.1 before 0.26.2, or hickory-proto through 0.26.0-alpha.1, are affected when they perform DNSSEC validation.

What must an attacker be able to do to exploit the issue?

The attacker must be able to supply or cause use of child-side NSEC or NSEC3 records that can be reused to falsely represent a delegation as insecure. This can enable forging records for the child zone.

What is the remediation?

Upgrade hickory-net to version 0.26.2 or later. The provided information does not identify a workaround for affected hickory-proto versions.

GHSA-7php-9j59-g3ch: Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks

Event History

Frequently Asked Questions

Which deployments are exposed to this validation bypass?

What must an attacker be able to do to exploit the issue?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this validation bypass?

What must an attacker be able to do to exploit the issue?

What is the remediation?