CVE-2026-123594

EUVD-2026-119353

08.11.2026, 02:16

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually proves the name exists as an empty non-terminal. On-path attackers can flip the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN, causing validators to accept forged nonexistence of the name.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.8 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 1.82%

Debian Releases

Debian Product

Codename

rust-hickory-net

forky	0.26.3-1 fixed
sid	0.26.3-1 fixed

rust-hickory-proto

forky	vulnerable
sid	vulnerable
trixie	vulnerable

Common Weakness Enumeration

CWE-345 - Insufficient Verification of Data Authenticity
The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-86vr-jm6c-7cpg

https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-nsec-validation-bypass-for-empty-non-terminals