Read the docs
TI-2026-86749 Aliases CVE-2026-123607GHSA-jvpj-j4xv-2492

Hickory DNS NSEC3 validation loop enables denial of service

Priority MEDIUM 53CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-835.

Summary

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop in NSEC3 closest-encloser proof validation (CWE-835) when the SOA owner is not an ancestor of the QNAME. A remote upstream attacker can return NoData or NXDomain responses with a cross-zone SOA record to panic debug builds or exhaust memory in release builds.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXDomain responses with a cross-zone SOA record to panic debug builds or exhaust memory in release builds.

Why it matters now

Fix Fixed hickory-dns (hickory-dns): 0.26.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
hickory-dnshickory-dns0.25.0-alpha.3 – 0.25.2—No fix listedCNA
hickory-dnshickory-dns0.26.0-alpha.1 to before 0.26.10.26.1Patch availableCNA
  • hickory-dns Vendorhickory-dns Affected 0.25.0-alpha.3 – 0.25.2 Fixed in — No fix listed CNA
  • hickory-dns Vendorhickory-dns Affected 0.26.0-alpha.1 to before 0.26.1 Fixed in 0.26.1 Patch available CNA

Remediation

Update hickory-dns to 0.26.1. The sources list no fixed version for hickory-dns 0.25.0-alpha.3 through 0.25.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

  • Fix · CNA hickory-dns (hickory-dns) Fixed in 0.26.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hickory-dns 0.26.1

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-86750 CPU exhaustion in Hickory DNS hickory-proto via BinEncoder name compressionPriority MEDIUM 53
    Show all 2 records →

Timeline

  1. 2026-11-08 Threatist record created from CVE-2026-123607
  2. 2026-11-08 Alias added: GHSA-jvpj-j4xv-2492

References

Advisory 1

  • TI-2025-18857 DNSSEC validation may accept broken authentication chains CVSS 4.0MEDIUM 5.7
  • TI-2026-86729 DNSSEC nonexistence forgery in Hickory DNS via wraparound NSEC CVSS 4.0HIGH 8.9
  • TI-2026-86750 CPU exhaustion in Hickory DNS hickory-proto via BinEncoder name compression CVSS 4.0HIGH 8.7
  • TI-2026-86748 Resource exhaustion in hickory-dns recursor via glueless NS referrals CVSS 4.0HIGH 8.7
  • TI-2026-86747 DNSSEC validation bypass in Hickory DNS via RRSIG signer name CVSS 4.0HIGH 8.7
  • TI-2026-86746 Unbounded retry loop in Hickory DNS resolver enables resource exhaustion CVSS 4.0HIGH 8.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences