CVE-2026-123581

Name of the Vulnerable Software and Affected Versions hickory-proto versions prior to 0.26.0-alpha.1 hickory-net versions 0.26.0-beta.1 through 0.26.1

Description A DNSSEC validation flaw exists where the system accepts a response as a positive answer if any valid RRset (Resource Record Set) appears in the answer section, failing to verify if the RRset actually corresponds to the query. This allows attackers to provide signed but unrelated RRsets, causing responses that lack matching records to be incorrectly validated as positive answers instead of no-data responses.

Recommendations Update hickory-proto to version 0.26.0-alpha.1 or later. Update hickory-net to version 0.26.2 or later.