UBUNTU-CVE-2026-123593: Medium severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.
Affected Software
Event History
Frequently Asked Questions
Which package versions are affected?
hickory-net is affected from 0.26.0-beta.1 before 0.26.2. hickory-proto is affected from 0.24.0 through 0.26.0-alpha.1.
What must an attacker be able to do to exploit this issue?
An attacker must be able to spoof or control name server responses. They can then substitute a secure zone's DNSKEY RRset with root-zone keys.
Why might the impact remain after the malicious response is delivered?
The attacker can assign a large TTL to the substituted DNSKEY RRset. This can cause the malicious key set to remain cached for an extended period.