Reported

September 3, 2026

Issued

November 13, 2026

Package

hickory-proto (crates.io)

Type

Vulnerability

Categories

• privilege-escalation

Keywords

#dns #dnssec #nsec

Aliases

• CVE-2026-123596
• GHSA-3r6v-f3jh-vvqm

References

• https://github.com/hickory-dns/hickory-dns/commit/2e3c829ea45000b1c409a64a03bd422618372471

Patched

no patched versions

Unaffected

• >=0.26.0-beta.1

Description

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation accepted the NSEC record that a parent zone signs at a delegation as proof that names below the zone cut, or other types at the cut, do not exist. Such a record only proves that no DS record exists there (RFC 6840 section 4.1). Someone who can answer or modify DNS responses could replay the parent's genuine signed records to get a denial for an existing name in the child zone accepted as secure.

From 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.

Advisory available under CC0-1.0 license.