GHSA-p2jv-r3m3-7wf4: Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3

Published Nov 8, 2026

Updated

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.

Event History

Nov 8, 2026

CVE Published

via OSV·01:38 AM

Data Sourced

via OSV·01:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which components and versions are affected?

The issue affects hickory-net from 0.26.0-beta.1 before 0.26.2, and hickory-proto through 0.26.0-alpha.1.

What does an attacker need to exploit this issue?

An attacker needs to be able to supply NSEC3 records from a different zone whose hashed label matches the label being checked. The vulnerable DNSSEC verification accepts the matching hash label without confirming that the NSEC3 record belongs to the correct zone.

What security outcome can exploitation produce?

Exploitation can forge DNSSEC proofs that a DNS name does not exist. This can cause DNSSEC verification to accept a nonexistence proof based on an NSEC3 record from another zone.

GHSA-p2jv-r3m3-7wf4: Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3

Event History

Frequently Asked Questions

Which components and versions are affected?

What does an attacker need to exploit this issue?

What security outcome can exploitation produce?

Company

Resources

Contact

Frequently Asked Questions

Which components and versions are affected?

What does an attacker need to exploit this issue?

What security outcome can exploitation produce?