CVE-2026-123599
Received Received - Intake

DNSSEC Validation Bypass in Hickory DNS

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123599
EUVD
EUVD-2026-119358

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hickory dns to 0.26.0-beta.1 (exc)
hickory dns to 0.26.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Hickory DNS versions before 0.26.0-beta.1 and hickory-net before 0.26.2 have a DNSSEC validation bypass. The verify_rrsets() function ignores the DNS class when partitioning RRsets, allowing non-IN records to skip signature verification while being marked as secure if IN records verify. Attackers can forge CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

Impact Analysis

Attackers could manipulate DNS responses to redirect users to malicious sites, intercept communications, or impersonate legitimate domains. This could lead to data theft, phishing attacks, or service disruption for users relying on Hickory DNS for DNSSEC validation.

Compliance Impact

This vulnerability may undermine compliance with GDPR and HIPAA by enabling attackers to forge DNS responses, potentially exposing sensitive data or disrupting secure communications. Organizations using affected Hickory DNS versions could face increased risk of data breaches or unauthorized access.

Mitigation Strategies

Update Hickory DNS hickory-proto to version 0.26.0-beta.1 or later and hickory-net to version 0.26.2 or later to address the DNSSEC validation bypass issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123599. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...