UBUNTU-CVE-2026-123600: Medium severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Hickory's DNSSEC validation through DnssecDnsHandle are affected if they use hickory-proto versions 0.25.0-alpha.3 through 0.25.2 or hickory-net versions 0.26.0-alpha.1 before 0.26.2. The issue specifically affects validation of NODATA responses for queries at a DNS zone apex.
What access does an attacker need?
An attacker must be able to intercept traffic on the DNS path or operate a malicious authoritative DNS server. No prior privileges or user interaction are required.
What is the practical impact of a successful attack?
An attacker can cause the resolver to accept an authenticated DNSSEC denial response, marked AD=1, for any record type at the zone apex. The false negative response can remain effective for the negative-cache TTL.
How can I identify a suspected exploitation attempt?
Look for DNSSEC-authenticated NODATA responses for zone-apex queries that include a signed SOA and a replayed NSEC3 record from a non-apex name. The affected validator may treat such a response as secure even though no NSEC3 record matches the hashed queried name.
What versions should be updated?
Update hickory-net to version 0.26.2 or later. For hickory-proto, the affected range ends at 0.25.2, so deployments should move beyond that affected version range.