CVE-2026-123580

Name of the Vulnerable Software and Affected Versions hickory-net versions 0.26.0-beta.1 through 0.26.1 hickory-proto versions prior to 0.26.0-alpha.1

Description Insufficient checks on NSEC3 record names during DNSSEC verification allow for the comparison of only the hashed label without confirming the record belongs to the correct zone. This allows attackers to supply NSEC3 records from a different zone that possess a matching hash label to forge DNSSEC nonexistence proofs.

Recommendations Update hickory-net to version 0.26.2 or later. Update hickory-proto to version 0.26.0-alpha.1 or later.