CVE-2026-123580 Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records...

CVE-2026-123580

The Hickory DNS software (specifically hickory-net versions 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1) contains a vulnerability during DNSSEC verification. The issue stems from insufficient checks on NSEC3 record names, where the system compares only the hashed label wi...