UBUNTU-CVE-2026-123595: High severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Deployments using the validating recursor functionality in affected hickory-proto or hickory-net versions are exposed. The flaw is in DNSSEC validation, specifically the recursor's NSEC3 handling.
What does an attacker need to exploit the flaw?
The attacker needs to deliver a DNS response constructed from genuinely signed parent NSEC3 records. No user interaction is required, and the published vector indicates network access with low attack complexity and low privileges.
What is the operational impact of a successful attack?
A successful response can cause a resolver to cache NXDOMAIN or NODATA results with the AD flag set for names that actually exist, including names below the affected zone cut. This can deny DNS resolution for those names.
Which versions are identified as affected?
The advisory identifies hickory-proto 0.25 through 0.26.0-alpha.1, and hickory-net 0.26.0-beta.1 before 0.26.2. The affected Ubuntu software packages are rust-hickory-proto and rust-hickory-net.