CVE-2026-123591

Name of the Vulnerable Software and Affected Versions hickory-net versions 0.26.0-beta.1 through 0.26.1 hickory-proto versions prior to 0.26.0-alpha.1

Description The software fails to verify that an NSEC or NSEC3 record denying a DS RRset also proves the existence of the delegation's NS record, as required by RFC 6840 §4.4. This allows attackers to reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records.

Recommendations Update hickory-net to version 0.26.2 or later. Update hickory-proto to version 0.26.0-alpha.1 or later.