UBUNTU-CVE-2026-123592: High severity ubuntu/rust-hickory-net vulnerability
The hickory-net crate in Hickory DNS 0.26.0-beta.1 before 0.26.2 allows DNSSEC validation bypass because Name's Hash ignores label lengths and ValidationCacheKey compares only that hash. An attacker controlling an unsigned delegation whose name differs from a signed target only in dot positions can prime an Insecure verdict, causing forged answers for the target to skip signature verification instead of returning SERVFAIL.
Affected Software
Event History
Frequently Asked Questions
How can I determine whether my deployment is affected?
Check whether it uses the hickory-net crate in Hickory DNS from 0.26.0-beta.1 through versions before 0.26.2. Deployments outside that stated version range are not identified as affected by the provided data.
What does an attacker need to exploit this issue?
The attacker must control an unsigned DNS delegation whose name differs from a signed target only in dot positions. The supplied vector indicates exploitation is network-reachable and does not require privileges or user interaction.
What is the practical result of a successful attack?
An attacker can prime an Insecure DNSSEC verdict for the signed target, causing forged answers for that target to bypass signature verification rather than produce SERVFAIL.