DNSSEC validation cache could reuse an Insecure result for a different name
Severity and exploitation
KEV coverage does not rule out exploitation.
Assessment vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NAssessment vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NSeverity
high8.2CVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Package fixes recorded
Fix versions are recorded for 1 of 1 mapped packages. Check each release branch and any separate product guidance.
What this means
Hickory-dns versions before 0.26.2 have a weakness where the DNSSEC validation cache can reuse an insecure result for a different name, potentially allowing an attacker with control over an unsigned delegation to serve a forged response. The attacker must have control over a colliding name. The impact is a failed validation.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Attack conditions
No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
hickory-dns · VulnCheck
hickory-dns
2 ranges
hickory-dns · VulnCheck
hickory-dns
Package identity
pkg:cargo/hickory-netExplore hickory-net →Identity supplied by VulnCheck. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0.26.0-beta.1 → before 0.26.2
semver versions
unaffected
0.26.2
semver versions
Other versions: unaffected
Packages
Compare each installed version with the publisher’s affected ranges. Where a fix is recorded, choose the appropriate release branch and test compatibility before upgrading.
| Affected range | Recorded fix |
|---|---|
| From 0.0.0-0 before 0.26.2Semantic versions | 0.26.2 |
Version evidence: OSV · RUSTSEC-2026-0518
View original version evidence (0 explicit versions)
What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
Use the recorded fix for your release branch. Review the publisher’s instructions and test compatibility before upgrading.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
The DNSSEC validation cache used a 64-bit hash of the query as its key, and two keys with the same hash counted as equal. The Hash implementation of Name hashed the bytes of the labels but not where one label ends and the next begins, so names that differ only in the placement of dots (such as ab.c. and a.bc.) hashed to the same value.
An attacker who controls an unsigned delegation whose name collides in this way with a name in a signed zone can first get an Insecure result cached for their own name. A forged response for the signed name is then served from that cache entry without signature checks and returned with the AD bit clear, where validation should have failed.
This affects DNSSEC validation through DnssecDnsHandle when built with dnssec-ring or dnssec-aws-lc-rs.
The fix stores the query in the cache key and compares it on lookup. The Hash implementations of Label, Name and LowerName in hickory-proto were also changed to include label boundaries. Both are in 0.26.2.
References
6 sourcesInside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-123592View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Contributing organizations · 2
Assigning organization
Additional data publisher
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Source updated
Latest modification date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changes- CVE · CVE-2026-123592
Observed 2026-11-13T01:45:01.435Z · upstream updated 2026-11-12T13:28:44.753Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-11-12T13:28:26.199703Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.