Bug 2568718 (CVE-2026-123582)
| Summary: | CVE-2026-123582 hickory-server: hickory-server: DNSSEC validation bypass via unverified SOA records in negative responses | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in hickory-server. When assembling negative responses, the validating recursive resolver and forwarder fail to verify whether the Start of Authority (SOA) record passed Domain Name System Security Extensions (DNSSEC) validation. A remote attacker capable of spoofing DNS responses can exploit this issue to deliver forged records marked as authentic to downstream clients. This flaw allows attackers to bypass security validation and mislead client systems into accepting untrusted domain information.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-08 02:01:55 UTC
|