UBUNTU-CVE-2026-123590: Medium severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to supply DNS responses to the affected Hickory component. They can combine a validly signed record with a bogus NSEC or NSEC3 record using the same owner name but a different type in the authority section.
What is the practical impact of a successful attack?
The attacker can forge DNSSEC nonexistence proofs. The reported impact is limited to integrity and availability; confidentiality impact is not indicated.
Which packages and versions are affected?
The issue affects hickory-net from 0.26.0-beta.1 before 0.26.2, and hickory-proto through 0.26.0-alpha.1. Ubuntu lists the relevant package names as rust-hickory-net and rust-hickory-proto.