DNSSEC Validation Flaw in Hickory DNS and Hickory Net Products
CVE-2026-123581

6.9MEDIUM

Key Information:

Vendor

Hickory-dns

Status
Hickory-dns
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123581?

Hickory DNS versions up to 0.26.0-alpha.1 and Hickory Net versions up to 0.26.0-beta.1 are susceptible to a flaw in DNSSEC validation. This vulnerability arises when the system accepts a positive validation response based solely on the presence of any valid Resource Record Set (RRset) in the answer section. It fails to ensure that the RRset corresponds to the original query. As a result, malicious actors can provide valid but unrelated RRsets, leading to incorrect validation of responses that should be considered as no-data.

Affected Version(s)

hickory-dns 0 <= 0.26.0-alpha.1

hickory-dns 0.26.0-beta.1 < 0.26.2

hickory-dns 0.26.2

References

https://github.com/hickory-dns/hickory-dns/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/hickory-dns-through-...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

qifan-sailboat
.