Read the docs
TI-2026-86741 Aliases CVE-2026-123599GHSA-rp29-c6r7-8r7c

Hickory DNS DNSSEC validation bypass via non-IN class records

Priority LOW 27CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 are affected. The verify_rrsets() function ignores the DNS class when it groups RRsets (CWE-345), so non-IN records skip signature verification yet are marked secure when the IN records verify. An attacker who can supply DNS responses can add forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marked secure when the IN records verify. Attackers able to supply DNS responses can include forged CH or HS class records, including DS records, to authenticate any DNSKEY and forge child zone responses.

Why it matters now

EPSS 0.0012 1st percentileScored 2026-11-08
Fix Fixed hickory-dns (hickory-dns): 0.26.0-beta.1, 0.26.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
hickory-dnshickory-dnsbefore 0.26.0-beta.10.26.0-beta.1Patch availableCNA
hickory-dnshickory-dns0.26.0-beta.1 to before 0.26.20.26.2Patch availableCNA
  • hickory-dns Vendorhickory-dns Affected before 0.26.0-beta.1 Fixed in 0.26.0-beta.1 Patch available CNA
  • hickory-dns Vendorhickory-dns Affected 0.26.0-beta.1 to before 0.26.2 Fixed in 0.26.2 Patch available CNA

Remediation

Hickory DNS 0.26.0-beta.1 fixes affected releases before that version, and 0.26.2 fixes releases from 0.26.0-beta.1 before 0.26.2. Upgrade hickory-dns to the fixed version for your release line.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA hickory-dns (hickory-dns) Fixed in 0.26.0-beta.1
  • Fix · CNA hickory-dns (hickory-dns) Fixed in 0.26.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hickory-dns 0.26.2

    36 records Highest priority Priority LOW 36 LOW

    Other records, highest priority first

    • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referralsPriority LOW 38
    • TI-2026-86746 Unbounded retry loop in Hickory DNS resolver enables resource exhaustionPriority LOW 38
    • TI-2026-86730 Denial of service in Hickory DNS recursive resolver via empty poolPriority LOW 38
    Show all 36 records →

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-123599
  2. 2026-11-08 Alias added: GHSA-rp29-c6r7-8r7c
  3. 2026-11-09 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2025-18857 DNSSEC validation may accept broken authentication chains CVSS 4.0MEDIUM 5.7
  • TI-2026-63089 hickory-resolver before 0.26.2 DNSSEC Validation Bypass CVSS 4.0HIGH 8.7
  • TI-2026-86750 CPU exhaustion in Hickory DNS hickory-proto via BinEncoder name compression CVSS 4.0HIGH 8.7
  • TI-2026-86749 Hickory DNS NSEC3 validation loop enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referrals CVSS 4.0HIGH 8.7
  • TI-2026-86746 Unbounded retry loop in Hickory DNS resolver enables resource exhaustion CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences