CVE-2026-123596

Name of the Vulnerable Software and Affected Versions hickory-proto versions prior to 0.26.0-alpha.1 hickory-net versions 0.26.0-beta.1 through 0.26.1

Description A DNSSEC validation flaw exists in the validating recursor's NSEC handler. The handler incorrectly accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names located below the zone cut. An on-path attacker, a rogue parent nameserver, or an attacker who wins a port and TXID race can deliver a forged NXDOMAIN response using genuinely signed parent NSEC records. This results in an authenticated denial of existing child-zone names, which are then cached for the negative TTL (Time to Live).

Recommendations Update hickory-proto to version 0.26.0-alpha.1 or later. Update hickory-net to version 0.26.2 or later.