UBUNTU-CVE-2026-123597: Medium severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the denial of service?
The attacker must be able to induce a SERVFAIL, REFUSED, or timeout response to a DS sub-query for a child zone. No privileges or user interaction are required.
What systems and DNS names are affected after exploitation?
A validator using the affected DS-fetch path returns SERVFAIL for all names beneath the targeted child zone. The condition persists until the cached entry's TTL expires.
Which package versions are affected?
hickory-proto is affected from 0.25.0-alpha.1 through 0.26.0-alpha.1. hickory-net is affected before version 0.26.2.