UBUNTU-CVE-2026-123594: Medium severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually proves the name exists as an empty non-terminal. On-path attackers can flip the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN, causing validators to accept forged nonexistence of the name.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be on the network path between the validator and the DNS responder, allowing them to alter DNS responses in transit. The attack targets validators processing signed DNS responses.
What does an attacker need to modify?
The attacker changes the unsigned response code of a genuine signed NODATA response from NOERROR to NXDOMAIN. The flawed NSEC validation can then accept a forged proof that the queried name does not exist.
What is the practical impact?
A successful attack causes the validator to accept forged DNS nonexistence for a name that actually exists as an empty non-terminal. The reported impact is limited to integrity and availability, with no confidentiality impact indicated.
Which Ubuntu software packages are affected?
The affected Ubuntu packages are rust-hickory-proto and rust-hickory-net. Hickory-proto is affected through 0.26.0-alpha.1, and hickory-net is affected before 0.26.2, including 0.26.0-beta.1.