UBUNTU-CVE-2026-123601: High severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of findcoveringrecord() in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to inject DNS responses can replay that NSEC3 record and its RRSIG to forge DNSSEC-validated negative responses denying legitimate names.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for triage?
Prioritize Ubuntu deployments using rust-hickory-proto versions 0.25.0 through 0.26.0-alpha.1 or rust-hickory-net versions 0.26.0-beta.1 before 0.26.2, particularly where the software performs DNSSEC validation.
What does an attacker need to exploit this issue?
The attacker must be able to inject DNS responses. They can replay the last NSEC3 record in a zone's hash ring together with its RRSIG to produce forged DNSSEC-validated negative responses.
What impact is indicated by the supplied severity data?
The vector indicates no confidentiality impact, low integrity impact, and high availability impact. It also indicates no privileges or user interaction are required, but exploitation has high attack complexity.