Bug 2568736 (CVE-2026-123590)
| Summary: | CVE-2026-123590 hickory-net: hickory-proto: Hickory DNS: Denial of service via forged DNSSEC nonexistence proofs | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dbosanac, jcantril, jlanda, jreimann, kshier, mdessi, mrizzi, pcattana, rbobbitt, rhel-process-autobot, rojacob, simaishi, stcannon, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Hickory DNS. A remote attacker capable of supplying DNS responses can cause a denial of service by forging Domain Name System Security Extensions (DNSSEC) nonexistence proofs. Due to improper signature validation, Hickory DNS accepts Next Secure (NSEC and NSEC3) records as valid whenever any other record with the same owner name is correctly signed. An attacker can exploit this by combining validly signed records with fabricated records in the authority section, causing legitimate domain names to be incorrectly treated as nonexistent.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-08 02:01:56 UTC
|