CVE-2026-123600

Hickory DNS components hickory-proto (versions 0.25.0-alpha.3 through 0.25.2) and hickory-net (versions 0.26.0-alpha.1 before 0.26.2) are affected by a DNSSEC validation flaw in DnssecDnsHandle . The vulnerability allows the system to incorrectly accept NSEC3-signed NODATA responses for zone-apex...

dnsmasq -- multiple vulnerabilities

Simon Kelley reports: Today, 11th May 2026 CERT is releasing a set of six CVEs for serious security vulnerabilities in dnsmasq. These are all long-standing bugs which apply to pretty much all non-ancient versions. Christopher Cullen and Molly Jaconski write, in Vulnerability Note VU471747:...

Hickory DNS data forgery vulnerability

Hickory DNS is a Rust-based DNS client, server, and resolver from the Hickory DNS open source. A data forgery issue vulnerability exists in Hickory DNS version 0.8.0 and earlier, which stems from the DNSSEC validation mechanism incorrectly treating DNSKEY records across RRsets as trusted, and a...

RUSTSEC-2025-0006 Hickory DNS failure to verify self-signed RRSIG for DNSKEYs

Summary The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to...