UBUNTU-CVE-2026-123591: High severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 fail to verify, per RFC 6840 §4.4, that an NSEC or NSEC3 record denying a DS RRset also proves the delegation's NS record exists. Attackers can reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
The attacker needs to supply or reuse child-side NSEC or NSEC3 records in a way that makes a DNSSEC-validating resolver accept a forged insecure delegation. This can then be used to forge records in the child zone.
Which Hickory components and versions are affected?
hickory-net is affected from 0.26.0-beta.1 through versions before 0.26.2. hickory-proto is affected through 0.26.0-alpha.1.
What is the integrity impact if exploitation succeeds?
An attacker can cause forged child-zone DNS records to be accepted by exploiting an improperly validated denial of a DS record. The reported impact is integrity-only; no confidentiality or availability impact is listed.