Read the docs
TI-2026-86729 Aliases CVE-2026-123587GHSA-2vx4-5gxp-vmjw

DNSSEC nonexistence forgery in Hickory DNS via wraparound NSEC

Priority MEDIUM 54CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

The DNSSEC validation in the Hickory DNS hickory-net crate from 0.26.0 before 0.26.2 accepts an SOA record without validating it when it identifies wraparound NSEC records. A remote attacker who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge the nonexistence of any RRset, which is classified as authentication bypass by spoofing (CWE-290).

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.

Why it matters now

Fix Fixed hickory-dns (hickory-dns): 0.26.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
hickory-dnshickory-dns0.26.0 to before 0.26.20.26.2Patch availableCNA
  • hickory-dns Vendorhickory-dns Affected 0.26.0 to before 0.26.2 Fixed in 0.26.2 Patch available CNA

Remediation

Upgrade hickory-dns to version 0.26.2, which is the fixed version for the affected 0.26.0 before 0.26.2 range.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA hickory-dns (hickory-dns) Fixed in 0.26.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hickory-dns 0.26.2

    36 records Highest priority Priority MEDIUM 36 MEDIUM

    Other records, highest priority first

    • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referralsPriority MEDIUM 53
    • TI-2026-86747 DNSSEC validation bypass in Hickory DNS via RRSIG signer namePriority MEDIUM 53
    • TI-2026-86746 Unbounded retry loop in Hickory DNS resolver enables resource exhaustionPriority MEDIUM 53
    Show all 36 records →

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-123587
  2. 2026-11-08 Alias added: GHSA-2vx4-5gxp-vmjw

References

Advisory 1

  • TI-2025-18857 DNSSEC validation may accept broken authentication chains CVSS 4.0MEDIUM 5.7
  • TI-2026-86750 CPU exhaustion in Hickory DNS hickory-proto via BinEncoder name compression CVSS 4.0HIGH 8.7
  • TI-2026-86749 Hickory DNS NSEC3 validation loop enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referrals CVSS 4.0HIGH 8.7
  • TI-2026-86747 DNSSEC validation bypass in Hickory DNS via RRSIG signer name CVSS 4.0HIGH 8.7
  • TI-2026-86746 Unbounded retry loop in Hickory DNS resolver enables resource exhaustion CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences