CVE-2026-123592

Name of the Vulnerable Software and Affected Versions Hickory DNS versions 0.26.0-beta.1 through 0.26.1

Description The hickory-net crate contains a flaw that allows DNSSEC validation bypass. This occurs because the Hash function of the Name object ignores label lengths, and the ValidationCacheKey relies solely on that hash for comparison. An attacker who controls an unsigned delegation with a name that differs from a signed target only by the position of dots can trigger an Insecure verdict. This results in forged answers for the target bypassing signature verification instead of the system returning a SERVFAIL (Server Failure) error.

Recommendations Update Hickory DNS to version 0.26.2.