Reported

September 3, 2026

Issued

November 12, 2026

Package

hickory-net (crates.io)

Type

Vulnerability

Categories

• privilege-escalation

Keywords

#dns #dnssec #cache

Aliases

• CVE-2026-123592
• GHSA-rx82-4p2j-j5cv

References

• https://github.com/hickory-dns/hickory-dns/commit/96b87c9ab0f10c1331cef56f88742eb00bce71e1
• https://github.com/hickory-dns/hickory-dns/commit/9c82ce0c529d33ef4b3d6507e3b8dbbb5cd0dd48

Patched

• >=0.26.2

Description

The DNSSEC validation cache used a 64-bit hash of the query as its key, and two keys with the same hash counted as equal. The Hash implementation of Name hashed the bytes of the labels but not where one label ends and the next begins, so names that differ only in the placement of dots (such as ab.c. and a.bc.) hashed to the same value.

An attacker who controls an unsigned delegation whose name collides in this way with a name in a signed zone can first get an Insecure result cached for their own name. A forged response for the signed name is then served from that cache entry without signature checks and returned with the AD bit clear, where validation should have failed.

This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.

The fix stores the query in the cache key and compares it on lookup. The Hash implementations of Label, Name and LowerName in hickory-proto were also changed to include label boundaries. Both are in 0.26.2.

Advisory available under CC0-1.0 license.