DNSSEC Validation Flaw in Hickory DNS Affects Multiple Versions

CVE-2026-123596

What is CVE-2026-123596?

A vulnerability exists in Hickory DNS versions hickory-proto prior to 0.26.0-alpha.1 and hickory-net before 0.26.2, which impacts the integrity of DNSSEC validation. This flaw allows an attacker to exploit the validating recursor's NSEC handler. By presenting forged NXDOMAIN responses derived from valid parent NSEC records, an on-path attacker or rogue parent nameserver can potentially cause authenticated denial of existing child-zone names. This presents a risk as it undermines the trustworthiness of DNS resolution and may lead to service disruption.

References