CVE-2026-123578

Name of the Vulnerable Software and Affected Versions hickory-net versions 0.26.0 through 0.26.1 hickory-proto versions 0.25.0 through 0.25.2

Description The software fails to verify that a UDP response's question section matches the original query and bypasses the case-randomization check when the response contains an empty question section (QDCOUNT=0). This allows remote attackers to inject spoofed UDP responses, which weakens defenses against DNS spoofing (a technique used to redirect network traffic to a fraudulent destination by providing false DNS records).

Recommendations Update hickory-net to version 0.26.2 or later. Update hickory-proto to version 0.25.3 or later.