DNSSEC Validation Bypass in Hickory DNS hickory-net Crate

Executive Summary

CVE-2026-123587 is a DNSSEC vulnerability in the Hickory DNS hickory-net crate versions 0.26.0 to 0.26.1. It allows attackers to forge the nonexistence of any resource record set by exploiting incorrect handling of wraparound NSEC records. The flaw occurs because DNSSEC validation compares NSEC records to an SOA record to detect wraparound, which can be spoofed. Attackers combine a valid NSEC record, its RRSIG, and a crafted SOA record to manipulate verification.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses the affected Hickory DNS versions (0.26.0 to 0.26.1). Inspect DNSSEC validation logs for nonexistence forgery attempts. Use commands like `cargo audit` for Rust projects or `grep` to search for hickory-dns version in dependency files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers who can supply DNS responses to deceive systems into believing certain records do not exist when they actually do. This could lead to data integrity issues, such as bypassing security checks or redirecting users to malicious sites. The impact is significant due to the high CVSS score of 8.9, indicating low attack complexity and no required privileges or user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to Hickory DNS version 0.26.2 or later. If using a package manager, run update commands like `cargo update -p hickory-dns` or equivalent for your system. Disable DNSSEC validation temporarily if an upgrade isn't possible, but this reduces security.

Useful 0 Not Useful 0