UBUNTU-CVE-2026-123580: High severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using the affected Ubuntu packages rust-hickory-proto or rust-hickory-net are exposed when they perform DNSSEC verification involving NSEC3 records. The issue affects hickory-net versions from 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1.
What does an attacker need to exploit it?
An attacker needs to supply an NSEC3 record from a different zone whose hashed label matches the label expected by the verifier. The flawed verification can then accept it as a DNSSEC proof of nonexistence for the wrong zone.