UBUNTU-CVE-2026-123607: High severity ubuntu/rust-hickory-proto vulnerability
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXDomain responses with a cross-zone SOA record to panic debug builds or exhaust memory in release builds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hickory-netto a version that resolves this vulnerability.Fixed in 0.26.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using hickory-proto versions 0.25.0-alpha.3 through 0.25.2, or hickory-net versions earlier than 0.26.1, are affected when they perform the vulnerable DNSSEC NSEC3 closest-encloser proof validation.
What does an attacker need to exploit this?
An upstream attacker needs to be able to return a NoData or NXDomain DNS response containing a cross-zone SOA record. No privileges or user interaction are required.
What is the practical impact in debug and release builds?
A crafted response can panic debug builds. In release builds, the unbounded loop can exhaust memory and cause a denial of service.