Advisory · CVE-2026-123595
Hickory DNSSEC validation accepts parent NSEC3 records as proof names do not exist
Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap, letting an attacker deliver one response built from genuinely signed parent NSEC3 records to cache NXDOMAIN or NODATA with AD=1, rated high at CVSS 8.8; fixed in 0.26.2.
- Vendor
- hickory-dns
- Product
- Hickory DNS
- Identifier / CWE
- CVE-2026-123595
CWE-345 - Action timing
- Immediate
Explain it like I’m five
Hickory's DNSSEC checker trusts a name-does-not-exist answer if the hash matches, without checking whether the proof actually covers that name. A signed record from the parent zone can be reused to make real names vanish from the cache.
- 01Response built from parent records
An attacker assembles a response from genuinely signed parent NSEC3 records.
- 02Hash-only match
The closest-encloser check matches by hash without checking the type bitmap.
- 03Proof accepted
The recursor caches NXDOMAIN or NODATA with the authenticated-data flag set.
- 04Names denied
Existing names at and below the zone cut stop resolving until the cache entry expires.
What happened
Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor’s NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
The poisoned answer carries the authenticated-data flag, so downstream caches and clients treat it as verified truth. One crafted response can deny a whole subtree of names. The flaw is fixed in 0.26.2.
What to do
- Inventory applications and services using Hickory DNS crates and record each version.
- Upgrade hickory-proto and hickory-net to 0.26.2 or later.
- Monitor for unexpected NXDOMAIN or NODATA responses for names that should exist.
- Review recursor cache entries and logs for ancestor-delegation NSEC3 records.
- Verify the deployed crate versions after updating.
Management note
A single response that poisons a resolver cache with the authenticated flag is a quiet, wide outage. Check what your resolvers cached, not just what version they run.