CVE-2026-123595

Name of the Vulnerable Software and Affected Versions hickory-proto versions 0.25 through 0.26.0-alpha.1 hickory-net versions 0.26.0-beta.1 through 0.26.1

Description A DNSSEC validation flaw exists in the validating recursor's NSEC3 handler. The handler matches the closest encloser using only the hash, failing to verify the type bitmap. This allows the system to accept parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker can provide a response constructed from signed parent NSEC3 records to cause NXDOMAIN or NODATA to be cached with the Authenticated Data (AD) flag set to 1, resulting in a denial of resolution for existing names at and below the zone cut.

Recommendations Update hickory-proto to a version later than 0.26.0-alpha.1. Update hickory-net to version 0.26.2 or later.