UBUNTU-CVE-2026-123599: Medium severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verifyrrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to supply DNS responses to a vulnerable Hickory DNS resolver or client. Exploitation relies on injecting forged records in a non-IN DNS class, such as CH or HS, alongside records whose IN-class signatures validate.
What can an attacker achieve through the validation bypass?
The attacker can use forged non-IN records, including DS records, to authenticate an arbitrary DNSKEY. This can enable forging DNS responses for child zones while they are treated as DNSSEC-secure.
Which package versions are affected?
The issue affects hickory-proto versions before 0.26.0-beta.1 and hickory-net versions before 0.26.2. The listed Ubuntu software packages are rust-hickory-proto and rust-hickory-net.