{"id":"CVE-2026-123595","aliases":["RUSTSEC-2026-0532","GHSA-624w-vvww-xvpw","RUSTSEC-2026-0541"],"title":"Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3","titleSource":"VulnCheck","descriptionSource":"OSV","description":"In hickory-proto 0.25.0 through 0.26.0-alpha.1, NSEC3 validation picked the closest encloser by hashed owner name alone and accepted the NSEC3 record that a parent zone signs at a delegation as proof that names at or below the zone cut do not exist. Such a record only proves that no DS record exists there (RFC 6840 section 4.1, RFC 5155 section 8.3). Someone who can answer or modify DNS responses could replay the parent's genuine signed records to get a denial for an existing name in the child zone accepted as secure.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in hickory-proto 0.25 (directly or through hickory-resolver or hickory-recursor 0.25) should move to the 0.26.2 or later releases, which validate through hickory-net.","severity":"high","score":8.8,"published":"2026-09-03T12:00:00.000Z","modified":"2026-11-13T12:55:46.260Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"crates.io","name":"hickory-proto","sources":[{"name":"OSV · RUSTSEC-2026-0532","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0532"}],"ranges":[{"events":[{"introduced":"0.25.0"},{"fixed":"0.26.0-beta.1"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.0-beta.1"]},{"ecosystem":"crates.io","name":"hickory-net","sources":[{"name":"OSV · RUSTSEC-2026-0541","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0541"}],"ranges":[{"events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.2"]}],"sourceAffected":[],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw","https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3","https://crates.io/crates/hickory-proto","https://rustsec.org/advisories/RUSTSEC-2026-0532.html","https://github.com/hickory-dns/hickory-dns/commit/889801333d7f18d59a4468100e8cd1859e083d43","https://crates.io/crates/hickory-net","https://rustsec.org/advisories/RUSTSEC-2026-0541.html"],"sources":[{"name":"CVE","id":"CVE-2026-123595","modified":"2026-11-13T03:09:41.021Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123595"},{"name":"OSV","id":"RUSTSEC-2026-0532","modified":"2026-11-13T12:55:46.260287377Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0532"},{"name":"OSV","id":"RUSTSEC-2026-0541","modified":"2026-11-13T12:55:46.260287377Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0541"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"cve":{"records":[{"id":"CVE-2026-123595","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T01:00:16.505Z","published":"2026-11-08T01:38:25.078Z","modified":"2026-11-13T03:09:41.021Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:38:25.078Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T03:09:41.021Z"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-345","description":"Insufficient Verification of Data Authenticity","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T03:09:24.664541Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"products":[{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.25","status":"affected","lessThanOrEqual":"0.26.0-alpha.1","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-proto","packageIdentity":{"ecosystem":"crates.io","name":"hickory-proto"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123595"},{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.26.0-beta.1","status":"affected","lessThan":"0.26.2","versionType":"semver"},{"version":"0.26.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-net","packageIdentity":{"ecosystem":"crates.io","name":"hickory-net"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123595"}],"remediation":[],"observedAt":"2026-11-13T19:08:00.613Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-08T02:15:34.683Z","attemptedAt":"2026-11-08T02:15:34.683Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T02:15:35.067Z","attemptedAt":"2026-11-08T02:15:35.067Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-08T02:15:35.247Z","attemptedAt":"2026-11-08T02:15:35.247Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T02:15:34.664Z","attemptedAt":"2026-11-08T02:15:34.664Z"}],"evidence":[],"aiSummary":{"text":"Hickory DNS through 0.26.0-alpha.1 has a DNSSEC validation bypass via ancestor-delegation NSEC3, allowing an attacker with access to DNS responses to replay signed records and deny existing names. The weakness is due to insufficient verification of data authenticity. Affected versions are hickory-proto 0.25.0 through 0.26.0-alpha.1.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-14T03:16:14.350Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123595"},{"name":"OSV","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0532"},{"name":"OSV","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0541"}]}}