Advisory · CVE-2026-123580
Hickory DNS can be tricked into accepting forged DNSSEC nonexistence proofs
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone, letting attackers forge DNSSEC nonexistence proofs, rated high at CVSS 8.7 under version 4.0; fixed in 0.26.2.
- Vendor
- hickory-dns
- Product
- Hickory DNS
- Identifier / CWE
- CVE-2026-123580
CWE-290 - Action timing
- Immediate
Explain it like I’m five
DNSSEC is how a resolver checks that a this-name-does-not-exist answer is genuine. Hickory checks only part of the proof, so a record borrowed from another zone can pass as proof that a real name does not exist.
- 01Attacker supplies NSEC3 records
NSEC3 records from another zone with a matching hash label are delivered to the resolver.
- 02Zone check skipped
Verification compares only the hashed label without confirming the record belongs to the correct zone.
- 03Forged proof accepted
The nonexistence proof validates as genuine.
- 04Real names hidden
Resolvers treat existing names as nonexistent and stop resolving them.
What happened
The DNS wire-format message handling in Hickory DNS performs insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs. The record rates it high at CVSS 8.7 under version 4.0, with network attack vector, low complexity, no privileges required, and no user interaction.
A forged nonexistence proof makes real names unresolvable, which reads as an outage rather than an attack. The flaw affects hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1, and is fixed in 0.26.2.
What to do
- Inventory applications and services using Hickory DNS crates and record each version.
- Upgrade hickory-proto and hickory-net to 0.26.2 or later.
- Monitor DNS resolution failures for names that should exist, especially after the disclosure.
- Review resolver logs for NSEC3 validation anomalies.
- Verify the deployed crate versions after updating.
Management note
A DNSSEC bypass that hides real names is an integrity failure dressed as an outage. If names went missing around the disclosure, treat it as a possible attack, not a glitch.