Bug 2568779 (CVE-2026-123600)
| Summary: | CVE-2026-123600 hickory-proto: hickory-net: Hickory DNS: Denial of Service via improper DNSSEC validation of negative responses | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dbosanac, jcantril, jlanda, jreimann, kshier, mdessi, mrizzi, pcattana, rbobbitt, rhel-process-autobot, rojacob, simaishi, stcannon, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Hickory DNS. This vulnerability allows an on-path attacker or a malicious authoritative server to cause a Denial of Service (DoS) by tricking the resolver into believing that legitimate domain records do not exist. The issue occurs because the Domain Name System Security Extensions (DNSSEC) validation handler incorrectly accepts cryptographic proof of non-existence without verifying that it matches the queried domain name. By replaying validly signed negative responses, an attacker can poison the resolver's cache and prevent clients from resolving valid domain services until the cached record expires.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-08 02:06:15 UTC
|