UBUNTU-CVE-2026-123582: Medium severity ubuntu/rust-hickory-server vulnerability
The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the SOA record passed DNSSEC validation when assembling NXDOMAIN or NODATA responses. An attacker able to supply forged DNS responses can have a forged SOA record returned to clients with the AD bit set, misleading clients that rely on the server's DNSSEC validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-serverto a version that resolves this vulnerability.Fixed in 0.26.2
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use hickory-server as a validating recursive resolver or validating forwarder. The issue applies to versions from 0.25.0 before 0.26.2.
What does an attacker need to exploit this issue?
An attacker must be able to supply forged DNS responses to the resolver or forwarder. No authentication or user interaction is required according to the supplied vector, but exploitation has high attack complexity.
What is the impact on clients?
A forged SOA record can be included in NXDOMAIN or NODATA responses with the AD bit set. This can mislead clients that rely on the server's DNSSEC validation, affecting the integrity of DNS response data.
What version resolves the issue?
Upgrade hickory-server to version 0.26.2 or later. Versions before 0.25.0 are not identified as affected by the provided information.