Skip to content
cve.newCreate a CVE report

hickory-proto

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.9
CVE-2026-123603

Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking deny_answers, deny_server, or AccessControlSet rules. Attackers can use IPv4-mapped addresses to evade answer filtering, trigger queries to denied nameservers, or reach hickory-server library deployments on dual-stack IPv6 sockets from denied clients.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123600

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123599

Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Records

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123597

Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors

Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123593

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via TrustAnchors

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123590

Hickory DNS 0.26.0-beta.1 before 0.26.2 Improper NSEC/NSEC3 Signature Validation

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed records with bogus same-name NSEC or NSEC3 records of different types in the authority section to forge nonexistence proofs.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123579

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansion

DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123578

Hickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0

Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section matches the query when the response has an empty question section (QDCOUNT=0), and also skip the case-randomization check. Remote attackers able to inject spoofed UDP responses can send QDCOUNT=0 responses to bypass these checks, weakening defenses against DNS spoofing.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
high8.3
CVE-2026-123601Package fixes recorded

Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery

In hickory-proto 0.25.0 through 0.26.0-alpha.1, DNSSEC validation handled the last NSEC3 record of a zone's hash chain with its two comparisons reversed. That record was treated as covering almost every hash it does not cover, so an attacker who can answer or modify DNS responses could replay it, with its RRSIG, to forge proofs that existing names have no records.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-proto crates.io
Affected range Recorded fix
From 0.25.0 before 0.26.0-beta.1Semantic versions0.26.0-beta.1

Version evidence: OSV · RUSTSEC-2026-0504

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.25.0"
        },
        {
          "fixed": "0.26.0-beta.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.8
CVE-2026-123596Package fixes recorded

Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation accepted the NSEC record that a parent zone signs at a delegation as proof that names below the zone cut, or other types at the cut, do not exist. Such a record only proves that no DS record exists there (RFC 6840 section 4.1). Someone who can answer or modify DNS responses could replay the parent's genuine signed records to get a denial for an existing name in the child zone accepted as secure.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-proto crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.0-beta.1Semantic versions0.26.0-beta.1

Version evidence: OSV · RUSTSEC-2026-0530

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.0-beta.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.8
CVE-2026-123595Package fixes recorded

Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3

In hickory-proto 0.25.0 through 0.26.0-alpha.1, NSEC3 validation picked the closest encloser by hashed owner name alone and accepted the NSEC3 record that a parent zone signs at a delegation as proof that names at or below the zone cut do not exist. Such a record only proves that no DS record exists there (RFC 6840 section 4.1, RFC 5155 section 8.3). Someone who can answer or modify DNS responses could replay the parent's genuine signed records to get a denial for an existing name in the child zone accepted as secure.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-proto crates.io
Affected range Recorded fix
From 0.25.0 before 0.26.0-beta.1Semantic versions0.26.0-beta.1

Version evidence: OSV · RUSTSEC-2026-0532

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.25.0"
        },
        {
          "fixed": "0.26.0-beta.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
medium6.3
CVE-2026-123594Package fixes recorded

Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals

Up to 0.26.0-alpha.1, hickory-proto's NSEC validation accepted an NXDOMAIN response as secure even when the covering NSEC record's next domain name was below the queried name, which proves the name exists as an empty non-terminal. Because the response code is not signed, someone who can modify DNS responses could turn a genuine signed NODATA response into an accepted NXDOMAIN.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-proto crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.0-beta.1Semantic versions0.26.0-beta.1

Version evidence: OSV · RUSTSEC-2026-0511

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.0-beta.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.2
CVE-2026-123591Package fixes recorded

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation accepted an NSEC or NSEC3 record from the child side of a zone cut, which has the SOA bit set, as proof that the parent has no DS record for the delegation (RFC 4035 section 5.2, RFC 6840 section 4.4). Someone who can answer or modify DNS responses could make a secure delegation look insecure and then forge records in the child zone.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-proto crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.0-beta.1Semantic versions0.26.0-beta.1

Version evidence: OSV · RUSTSEC-2026-0531

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.0-beta.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
medium6.9
CVE-2026-123581Package fixes recorded

Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation treated a response with a non-empty answer section as a positive answer if its records validated, without checking that any of them matched the queried name and type. Someone who can answer or modify DNS responses could return a genuine signed RRset for another name or type and have it accepted as a validated answer.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-proto crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.0-beta.1Semantic versions0.26.0-beta.1

Version evidence: OSV · RUSTSEC-2026-0512

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.0-beta.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.7
CVE-2026-123580Package fixes recorded

Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation matched NSEC3 records to a name only by the hashed first label of the NSEC3 owner name, without checking that the rest of the owner name was the zone in question. A signed NSEC3 record from any zone the attacker controls could therefore be used, by someone who can answer or modify DNS responses, to prove that a name in another zone does not exist.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-proto crates.io
Affected range Recorded fix
From 0.0.0-0 before 0.26.0-beta.1Semantic versions0.26.0-beta.1

Version evidence: OSV · RUSTSEC-2026-0505

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.0.0-0"
        },
        {
          "fixed": "0.26.0-beta.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.7
CVE-2026-123574Package fixes recorded

Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser

The zone file lexer read each token in a loop capped at 4,096 iterations, with an assert! on the loop counter as a safety bound. A single token long enough to reach that bound, for example a very long name or character string in a zone file, triggered the assertion and the parser panicked instead of returning the token or an error.

Recorded fixes — hickory-proto: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-proto
hickory-proto crates.io
Affected range Recorded fix
From 0.24.0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0490

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.24.0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.7
CVE-2026-123573Package fixes recorded

hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser

When an SVCB or HTTPS record is parsed from its text (zone file) form, surrounding double quotes are removed from each service parameter value by checking that the value starts and ends with " and slicing off the first and last character. A value that is a single " (for example alpn=") passes that check, and the slice [1..0] panics.

Recorded fixes — hickory-proto: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-proto
hickory-proto crates.io
Affected range Recorded fix
From 0.20.1 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0489

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.20.1"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.7
CVE-2026-123572Package fixes recorded

Panic on a malformed `alpn` value when parsing SVCB or HTTPS records from text

When an SVCB or HTTPS record is parsed from its text (zone file) form, the alpn service parameter value is split into a list of protocol names. That step called expect on the result, on the assumption that it could not fail. A malformed value, such as one with an unbalanced quote (alpn="h), two commas in a row or an invalid escape, makes it fail, so the parser panicked instead of returning an error.

Recorded fixes — hickory-proto: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-proto
hickory-proto crates.io
Affected range Recorded fix
From 0.20.1 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0487

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.20.1"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.7
CVE-2026-123571Package fixes recorded

Integer underflow when reporting a malformed TSIG record

When a TSIG record is decoded from the DNS wire format, its MAC length and "other data" length are checked against the end of the record data. If a check failed, the error value was built from end_idx - decoder.index(). For a malformed record the decoder can already be past end_idx, so this unsigned subtraction underflows.

Recorded fixes — hickory-proto: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-proto
hickory-proto crates.io
Affected range Recorded fix
From 0.26.0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0488

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.26.0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.7
CVE-2026-123570Package fixes recorded

Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Counts

When a DNS message is decoded, the vectors for the question, answer, authority and additional sections were created with Vec::with_capacity set to the counts in the message header. Those counts come from the sender and are not checked against the size of the message, so a single small packet that claims 65,535 records makes the decoder reserve memory for that many records (about 18 MB, according to the upstream advisory) before it reads any record and fails.

Recorded fixes — hickory-proto: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-proto
hickory-proto crates.io
Affected range Recorded fix
From 0.18.0 before 0.26.2Semantic versions0.26.2

Version evidence: OSV · RUSTSEC-2026-0491

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.18.0"
        },
        {
          "fixed": "0.26.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
hickory-proto crates.io
Affected range Recorded fix
From 0.3.1 before 0.26.1Semantic versions0.26.1

Version evidence: OSV · GHSA-q2qq-hmj6-3wpp

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.3.1"
        },
        {
          "fixed": "0.26.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
hickory-proto crates.io
Affected range Recorded fix
From 0.3.1 before 0.26.1Semantic versions0.26.1

Version evidence: OSV · RUSTSEC-2026-0119

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.3.1"
        },
        {
          "fixed": "0.26.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
high8.7
CVE-2026-123607Package fixes recorded

hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

The NSEC3 closest-encloser proof validation in hickory-proto's DnssecDnsHandle walks from the QNAME up to the SOA owner name, building a list of candidate encloser names. The iterator used assumes the QNAME is a descendant of the SOA owner, terminating only when the current candidate equals the SOA name. When the SOA in a response's authority section is not an ancestor of the QNAME, the loop stalls at the DNS root and never terminates, repeatedly calling Name::base_name() and pushing newly allocated Name and hashed-name entries into the candidate Vec.

Recorded fixes — hickory-proto: 0.26.0-beta.1; hickory-net: 0.26.1. Check your release branch.

Exploitation not established

crates.io / hickory-protocrates.io / hickory-net
hickory-proto crates.io
Affected range Recorded fix
From 0.25.0-alpha.3 through 0.25.2 (inclusive)Semantic versionsNot recorded

Version evidence: OSV · GHSA-3v94-mw7p-v465

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.25.0-alpha.3"
        },
        {
          "last_affected": "0.25.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}
hickory-proto crates.io
Affected range Recorded fix
From 0.25.0-alpha.3 before 0.26.0-beta.1Semantic versions0.26.0-beta.1

Version evidence: OSV · RUSTSEC-2026-0118

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.25.0-alpha.3"
        },
        {
          "fixed": "0.26.0-beta.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}