CVE-2026-123601

Name of the Vulnerable Software and Affected Versions hickory-proto versions 0.25.0 through 0.26.0-alpha.1 hickory-net versions 0.26.0-beta.1 through 0.26.1

Description An issue exists where relational operators are inverted in the wrap-around branch of the find covering record() function within nsec3.rs. This causes the final NSEC3 record in a zone's hash ring to cover every hash except its own owner. Consequently, attackers capable of injecting DNS responses can replay that NSEC3 record and its RRSIG to forge DNSSEC-validated negative responses, effectively denying legitimate names.

Recommendations Update hickory-proto to version 0.26.0-beta.1 or later. Update hickory-net to version 0.26.2 or later.