UBUNTU-CVE-2026-123587: High severity ubuntu/rust-hickory-net vulnerability
The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
The attacker must be able to supply DNS responses to the affected resolver or validator. Exploitation combines a genuine NSEC record and its RRSIG with a crafted SOA record that is accepted despite failing validation.
What is the practical impact of a successful attack?
An attacker can forge proof that any DNS RRset does not exist. This can cause DNSSEC validation to accept fraudulent nonexistence results.
Which versions are affected?
The issue affects hickory-net version 0.26.0 before 0.26.2. The listed Ubuntu package is rust-hickory-net.