PT-2026-139860

CVE-2026-123579

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions hickory-net versions 0.26.0-beta.1 through 0.26.1 hickory-proto versions prior to 0.26.0-alpha.1

Description DNSSEC validation fails to distinguish between NODATA responses and wildcard-expanded positive responses. In zones containing wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record to create a fraudulent positive response that the validation process accepts.

Recommendations Update hickory-net to version 0.26.2 or later. Update hickory-proto to version 0.26.0-alpha.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-358: Improperly Implemented Security Check for Standard

Related identifiers

CVE-2026-123579