UBUNTU-CVE-2026-123596: High severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. An on-path attacker, rogue parent nameserver, or attacker winning a port and TXID race can deliver one forged NXDOMAIN response built from genuinely signed parent NSEC records, causing authenticated denial of existing child-zone names cached for the negative TTL.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using the affected Ubuntu rust-hickory-proto or rust-hickory-net packages as a DNSSEC-validating recursive resolver are exposed. The impact is denial of access to existing names in a child zone, rather than disclosure or modification of the DNS records themselves.
What does an attacker need to exploit it?
An attacker must be able to supply a forged NXDOMAIN response using genuinely signed NSEC records from the parent zone. The advisory identifies three viable positions: an on-path attacker, a rogue parent nameserver, or an attacker able to win a DNS source-port and transaction-ID race.
How long can the denial of service persist?
The forged negative response can cause existing child-zone names to be treated as nonexistent for the negative TTL. The available data does not specify a fixed duration because it depends on that TTL.