Skip to content
cve.newCreate a CVE report

hickory-net

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.3
CVE-2026-123600

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123599

Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123598

Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoning

The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0.26.2 caches DNSSEC-bogus answers using the untrusted, attacker-supplied record TTL (capped at 24 hours) instead of a short validation-failure TTL. A remote attacker who spoofs a single authoritative response with an invalid signature and a long TTL can keep the bogus result cached for up to 24 hours.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123597

Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors

Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123593

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via TrustAnchors

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123590

Hickory DNS 0.26.0-beta.1 before 0.26.2 Improper NSEC/NSEC3 Signature Validation

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123579

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansion

DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123578

Hickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0

Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section matches the query when the response has an empty question section (QDCOUNT=0), and also skip the case-randomization check. Remote attackers able to inject spoofed UDP responses can send QDCOUNT=0 responses to bypass these checks, weakening defenses against DNS spoofing.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
hickory-net crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0507

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.3
CVE-2026-123601Package fixes recorded

Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery

In hickory-proto 0.25.0 through 0.26.0-alpha.1, DNSSEC validation handled the last NSEC3 record of a zone's hash chain with its two comparisons reversed. That record was treated as covering almost every hash it does not cover, so an attacker who can answer or modify DNS responses could replay it, with its RRSIG, to forge proofs that existing names have no records.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0506

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.8
CVE-2026-123596Package fixes recorded

Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation accepted the NSEC record that a parent zone signs at a delegation as proof that names below the zone cut, or other types at the cut, do not exist. Such a record only proves that no DS record exists there (RFC 6840 section 4.1). Someone who can answer or modify DNS responses could replay the parent's genuine signed records to get a denial for an existing name in the child zone accepted as secure.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0539

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.8
CVE-2026-123595Package fixes recorded

Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3

In hickory-proto 0.25.0 through 0.26.0-alpha.1, NSEC3 validation picked the closest encloser by hashed owner name alone and accepted the NSEC3 record that a parent zone signs at a delegation as proof that names at or below the zone cut do not exist. Such a record only proves that no DS record exists there (RFC 6840 section 4.1, RFC 5155 section 8.3). Someone who can answer or modify DNS responses could replay the parent's genuine signed records to get a denial for an existing name in the child zone accepted as secure.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0541

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
medium6.3
CVE-2026-123594Package fixes recorded

Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals

Up to 0.26.0-alpha.1, hickory-proto's NSEC validation accepted an NXDOMAIN response as secure even when the covering NSEC record's next domain name was below the queried name, which proves the name exists as an empty non-terminal. Because the response code is not signed, someone who can modify DNS responses could turn a genuine signed NODATA response into an accepted NXDOMAIN.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0519

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.2
CVE-2026-123592Package fixes recorded

DNSSEC validation cache could reuse an Insecure result for a different name

The DNSSEC validation cache used a 64-bit hash of the query as its key, and two keys with the same hash counted as equal. The Hash implementation of Name hashed the bytes of the labels but not where one label ends and the next begins, so names that differ only in the placement of dots (such as ab.c. and a.bc.) hashed to the same value.

Recorded fixes — hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0518

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.2
CVE-2026-123591Package fixes recorded

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation accepted an NSEC or NSEC3 record from the child side of a zone cut, which has the SOA bit set, as proof that the parent has no DS record for the delegation (RFC 4035 section 5.2, RFC 6840 section 4.4). Someone who can answer or modify DNS responses could make a secure delegation look insecure and then forge records in the child zone.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0540

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.9
CVE-2026-123587Package fixes recorded

NSEC wraparound detection trusted an unvalidated SOA record

The last NSEC record in a zone points back to the zone apex. To recognise it, DNSSEC validation treated an NSEC record as covering every name after its owner when its next domain name equalled the owner name of an SOA record in the response. That SOA record did not have to pass validation.

Recorded fixes — hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.26.0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0508

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.26.0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.2
CVE-2026-123584Package fixes recorded

Spoofed malformed UDP datagrams abort DNS lookups

While waiting for a reply on a UDP connection, the client parsed every datagram that arrived from the name server's address and port before checking its message ID. If parsing failed, the attempt ended with an error instead of dropping the datagram and waiting for the real reply. The receive loop also gave up after three datagrams.

Recorded fixes — hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.26.0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0517

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.26.0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
medium6.9
CVE-2026-123581Package fixes recorded

Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation treated a response with a non-empty answer section as a positive answer if its records validated, without checking that any of them matched the queried name and type. Someone who can answer or modify DNS responses could return a genuine signed RRset for another name or type and have it accepted as a validated answer.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0520

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.7
CVE-2026-123580Package fixes recorded

Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation matched NSEC3 records to a name only by the hashed first label of the NSEC3 owner name, without checking that the rest of the owner name was the zone in question. A signed NSEC3 record from any zone the attacker controls could therefore be used, by someone who can answer or modify DNS responses, to prove that a name in another zone does not exist.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0509

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.7
CVE-2026-123607Package fixes recorded

hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

The NSEC3 closest-encloser proof validation in hickory-proto's DnssecDnsHandle walks from the QNAME up to the SOA owner name, building a list of candidate encloser names. The iterator used assumes the QNAME is a descendant of the SOA owner, terminating only when the current candidate equals the SOA name. When the SOA in a response's authority section is not an ancestor of the QNAME, the loop stalls at the DNS root and never terminates, repeatedly calling Name::base_name() and pushing newly allocated Name and hashed-name entries into the candidate Vec.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.1. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-net crates.io
Affected range Recorded fix
From 0.26.0-alpha.1 before 0.26.1Semantic versions0.26.1

Version evidence: OSV · GHSA-3v94-mw7p-v465

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.26.0-alpha.1"
        },
        {
          "fixed": "0.26.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
hickory-net crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.1Semantic versions0.26.1

Version evidence: OSV · RUSTSEC-2026-0120

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}