CVE-2026-123590

Name of the Vulnerable Software and Affected Versions hickory-net versions 0.26.0-beta.1 through 0.26.1 hickory-proto versions prior to 0.26.0-alpha.1

Description The software incorrectly accepts NSEC and NSEC3 records for DNSSEC nonexistence proofs when another record with the same owner name passes signature validation. This allows attackers who can supply DNS responses to mix validly signed records with fraudulent same-name NSEC or NSEC3 records of different types within the authority section to forge nonexistence proofs. DNSSEC (Domain Name System Security Extensions) is a suite of extensions that add a layer of security to the DNS protocol by enabling DNS responses to be digitally signed.

Recommendations Update hickory-net to version 0.26.2 or later. Update hickory-proto to version 0.26.0-alpha.1 or later.