DNSSEC Validation Bypass in Hickory DNS by Hickory

CVE-2026-123592

What is CVE-2026-123592?

The hickory-net crate in Hickory DNS version 0.26.0-beta.1 and earlier versions before 0.26.2 is susceptible to a DNSSEC validation bypass. This flaw results from the Name's Hash disregarding label lengths, and the ValidationCacheKey only comparing that hash. An attacker controlling an unsigned delegation, whose name differs from a signed target solely by dot positions, can manipulate the system to prioritize an Insecure verdict. This can allow for forged DNS responses to evade signature verification and lead to potential security breaches instead of eliciting a SERVFAIL error.

References