CVE-2026-123600

Name of the Vulnerable Software and Affected Versions hickory-proto versions 0.25.0-alpha.3 through 0.25.2 hickory-net versions 0.26.0-alpha.1 through 0.26.1

Description A DNSSEC validation flaw exists in the DnssecDnsHandle function. The issue allows NSEC3-signed NODATA responses for zone-apex queries to be accepted as secure even without an NSEC3 record that matches the hashed QNAME. This enables on-path attackers or malicious authoritative servers to replay a validly signed non-apex NSEC3 along with the zone's signed SOA to provide an authenticated denial of any apex RRtype for the duration of the negative-cache TTL.

Recommendations Update hickory-proto to version 0.25.3 or later. Update hickory-net to version 0.26.2 or later.