UBUNTU-CVE-2026-123579: Medium severity ubuntu/rust-hickory-proto vulnerability
DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using DNSSEC validation in affected hickory-net or hickory-proto versions are exposed when handling queries that should produce NODATA responses in zones containing wildcard records.
What must an attacker provide for validation to accept a bogus answer?
The attacker must combine an NSEC3 record matching the queried name with a signed wildcard record, producing a bogus positive response for a query that should return NODATA.
How can I determine whether my installation is affected?
Check whether it uses hickory-net from 0.26.0-beta.1 before 0.26.2, or hickory-proto through 0.26.0-alpha.1, and whether DNSSEC validation is enabled or used.