{"id":"CVE-2026-123601","aliases":["RUSTSEC-2026-0504","GHSA-588m-chg6-8jqj","RUSTSEC-2026-0506"],"title":"Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery","titleSource":"VulnCheck","descriptionSource":"OSV","description":"In hickory-proto 0.25.0 through 0.26.0-alpha.1, DNSSEC validation handled the last NSEC3 record of a zone's hash chain with its two comparisons reversed. That record was treated as covering almost every hash it does not cover, so an attacker who can answer or modify DNS responses could replay it, with its RRSIG, to forge proofs that existing names have no records.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in hickory-proto 0.25 (directly or through hickory-resolver or hickory-recursor 0.25) should move to the 0.26.2 or later releases, which validate through hickory-net.","severity":"high","score":8.3,"published":"2026-09-03T12:00:00.000Z","modified":"2026-11-12T14:10:49.815Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"crates.io","name":"hickory-proto","sources":[{"name":"OSV · RUSTSEC-2026-0504","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0504"}],"ranges":[{"events":[{"introduced":"0.25.0"},{"fixed":"0.26.0-beta.1"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.0-beta.1"]},{"ecosystem":"crates.io","name":"hickory-net","sources":[{"name":"OSV · RUSTSEC-2026-0506","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0506"}],"ranges":[{"events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}],"type":"SEMVER"}],"versions":[],"fixed":["0.26.2"]}],"sourceAffected":[],"references":["https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-588m-chg6-8jqj","https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-nsec3-proof-of-nonexistence-forgery","https://crates.io/crates/hickory-proto","https://rustsec.org/advisories/RUSTSEC-2026-0504.html","https://github.com/hickory-dns/hickory-dns/commit/87ee4f81aa9689d81847770d3a74e13982c9bcdc","https://crates.io/crates/hickory-net","https://rustsec.org/advisories/RUSTSEC-2026-0506.html"],"sources":[{"name":"CVE","id":"CVE-2026-123601","modified":"2026-11-10T17:57:10.157Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123601"},{"name":"OSV","id":"RUSTSEC-2026-0504","modified":"2026-11-12T14:10:49.815536430Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0504"},{"name":"OSV","id":"RUSTSEC-2026-0506","modified":"2026-11-12T14:10:49.815536430Z","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0506"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","score":8.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","score":6.5}],"cve":{"records":[{"id":"CVE-2026-123601","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T01:00:16.506Z","published":"2026-11-08T01:38:29.320Z","modified":"2026-11-10T17:57:10.157Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:38:29.320Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T17:57:10.157Z"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-588m-chg6-8jqj","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-nsec3-proof-of-nonexistence-forgery","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-480","description":"Use of Incorrect Operator","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T15:42:05.282990Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.26.0-beta.1","status":"affected","lessThan":"0.26.2","versionType":"semver"},{"version":"0.26.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-net","packageIdentity":{"ecosystem":"crates.io","name":"hickory-net"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123601"},{"vendor":"hickory-dns","name":"hickory-dns","platforms":[],"versions":[{"version":"0.25.0","status":"affected","lessThanOrEqual":"0.26.0-alpha.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-proto","packageIdentity":{"ecosystem":"crates.io","name":"hickory-proto"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123601"}],"remediation":[],"observedAt":"2026-11-12T21:53:07.598Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:25:32.844Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-08T02:10:34.267Z","attemptedAt":"2026-11-08T02:10:34.267Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T02:10:34.267Z","attemptedAt":"2026-11-08T02:10:34.267Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-08T02:10:34.267Z","attemptedAt":"2026-11-08T02:10:34.267Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T02:10:34.267Z","attemptedAt":"2026-11-08T02:10:34.267Z"}],"evidence":[],"aiSummary":{"text":"Hickory DNS 0.25.0 through 0.26.0-beta.1 has a weakness where an attacker who can answer or modify DNS responses could forge proofs of nonexistence. The issue is due to incorrect handling of NSEC3 records. Users should move to version 0.26.2 or later.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T04:11:08.881Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123601"},{"name":"OSV","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0504"},{"name":"OSV","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0506"}]}}