DNSSEC Validation Vulnerability in Hickory DNS by Hickory

CVE-2026-123587

What is CVE-2026-123587?

The Hickory DNS implementation in the hickory-net crate prior to version 0.26.2 contains a DNSSEC validation issue that may allow attackers to exploit the handling of wraparound NSEC records. Specifically, the flaw arises from an improper comparison between the next domain name and an SOA record in the DNS response. This may lead to unauthorized acceptance of SOA records that should otherwise fail validation, permitting attackers to potentially forge domain non-existence of any RRset by leveraging a legitimate NSEC record combined with a crafted SOA record. This weakness poses a significant threat as it can lead to manipulation of domain name resolutions.

References