DNSSEC Validation Flaw in Hickory DNS by Hickory Software

CVE-2026-123600

What is CVE-2026-123600?

A security flaw has been identified in Hickory DNS implementations that affects specific versions of hickory-proto and hickory-net. The flaw allows for DNSSEC validation to improperly accept NSEC3-signed NODATA responses as secure, even without a matching NSEC3 record for the hashed QNAME. This vulnerability can be exploited by on-path attackers or malicious authoritative servers who can authenticate a denial response for any apex RRtype, potentially serving incorrect data while appearing valid. Users of affected versions should apply the necessary patches to mitigate this security risk.

References