Insufficient DNSSEC Validation in Hickory DNS by Hickory
CVE-2026-123580

8.7HIGH

Key Information:

Vendor

Hickory-dns

Status
Hickory-dns
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123580?

Hickory DNS versions 0.26.0-beta.1 and earlier exhibit faulty DNSSEC verification due to inadequate checks on NSEC3 record names. The flaw allows attackers to craft valid NSEC3 records from a different zone that match hash labels, potentially leading to the forgery of DNSSEC nonexistence proofs. This oversight during the verification process can compromise the integrity of DNS responses, enabling malicious activities.

Affected Version(s)

hickory-dns 0.26.0-beta.1 < 0.26.2

hickory-dns 0 <= 0.26.0-alpha.1

hickory-dns 0.26.2

References

https://github.com/hickory-dns/hickory-dns/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/hickory-dns-0.26.0-b...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

qifan-sailboat
.