CVE-2026-123580 PUBLISHED

Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3

Assigner: VulnCheck
Reserved: 06.11.2026 Published: 08.11.2026 Updated: 08.11.2026

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor hickory-dns
Product hickory-dns
Versions Default: unaffected
  • affected from 0.26.0-beta.1 to 0.26.2 (excl.)
  • Version 0.26.2 is unaffected
Vendor hickory-dns
Product hickory-dns
Versions Default: unaffected
  • affected from 0 to 0.26.0-alpha.1 (incl.)

Credits

  • qifan-sailboat reporter

References

Problem Types

  • Authentication Bypass by Spoofing CWE