CVE-2026-123578
Received Received - Intake

Hickory-net DNS Spoofing via Empty Question Section

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section matches the query when the response has an empty question section (QDCOUNT=0), and also skip the case-randomization check. Remote attackers able to inject spoofed UDP responses can send QDCOUNT=0 responses to bypass these checks, weakening defenses against DNS spoofing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123578
EUVD
EUVD-2026-119337

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hickory-dns hickory-dns From 0.25.0 (inc) to 0.25.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Hickory DNS versions hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2. It allows attackers to bypass DNS spoofing defenses by sending UDP responses with an empty question section (QDCOUNT=0). The system fails to verify if the response's question section matches the original query or perform case-randomization checks, enabling spoofed responses to go undetected.

Impact Analysis

Attackers could exploit this to redirect users to malicious websites by spoofing DNS responses. This may lead to phishing attacks, credential theft, or malware distribution. Systems using affected Hickory DNS versions are at risk of unauthorized network traffic interception or manipulation.

Mitigation Strategies

Update Hickory DNS to versions hickory-net 0.26.2 or later and hickory-proto 0.25.3 or later to address the DNS spoofing vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123578. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...