CVE-2026-123597 Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors

Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a...

CVE-2026-123597

Hickory DNS versions hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 are affected by a logic bug in the DnssecDnsHandle's DS-fetch path . The vulnerability allows transient DS lookup errors—such as SERVFAIL , REFUSED , or timeouts—to be incorrectly cached as Bogu...

CVE-2026-123597: hickory-dns: Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in…

Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a...