CVE-2026-123593

Name of the Vulnerable Software and Affected Versions hickory-net versions 0.26.0-beta.1 through 0.26.1 hickory-proto versions 0.24.0 through 0.26.0-alpha.1

Description The software compares DNSKEY public keys against DNSSEC trust anchors without verifying the DNSKEY record name. This allows an RRset consisting only of trusted keys to be accepted without RRSIG verification. Attackers who can spoof or control name server responses may replace a secure zone's DNSKEY RRset with the root zone's keys and employ a large TTL (Time to Live) to maintain the cached state.

Recommendations Update hickory-net to version 0.26.2 or later. Update hickory-proto to a version later than 0.26.0-alpha.1.