CVE-2026-123601

The Hickory DNS library is vulnerable to an NSEC3 Proof of Nonexistence Forgery in hickory-proto versions 0.25.0 through 0.26.0-alpha.1 and hickory-net versions 0.26.0-beta.1 before 0.26.2 . The root cause is inverted relational operators within the wrap-around branch of the find_covering_record(...

CVE-2026-123587 Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC

The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC...

CVE-2026-123587 Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC

The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC...

CVE-2026-123587

The Hickory DNS hickory-net crate versions 0.26.0 before 0.26.2 is vulnerable to a DNSSEC Nonexistence Forgery via wraparound NSEC. The root cause is that the crate identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, incorrectly accepting the SOA...