Bug 2568763 (CVE-2026-123587)
| Summary: | CVE-2026-123587 hickory-net: hickory-net: DNSSEC validation bypass via unverified SOA records | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in hickory-net. During Domain Name System Security Extensions (DNSSEC) validation, unverified Start of Authority (SOA) records are accepted when evaluating Next Secure (NSEC) records. A remote attacker capable of providing DNS responses can exploit this vulnerability by combining a genuine NSEC record with a crafted SOA record to forge the nonexistence of arbitrary domain records. This allows the attacker to bypass DNSSEC integrity checks and cause client applications to fail when resolving legitimate domain names.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-08 02:02:08 UTC
|