DNSSEC Validation Flaw in Hickory DNS Products by Hickory

CVE-2026-123595

What is CVE-2026-123595?

Hickory DNS versions 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 are impacted by a significant DNSSEC validation flaw. This vulnerability exists in the validating recursor's NSEC3 handler, which improperly matches records using a hashing method without verifying the type bitmap. As a result, this flaw allows for the acceptance of NSEC3 records that have been delegated by parent zones, potentially leading to DNS resolution issues. An attacker can exploit this vulnerability by sending responses made from legitimate signed parent NSEC3 records, resulting in the caching of NXDOMAIN or NODATA responses with the AD=1 flag, blocking the resolution of legitimate names within the affected zones.

References