Bug 2568800 (CVE-2026-123591) - CVE-2026-123591 hickory-net: hickory-proto: Hickory DNS: DNSSEC validation bypass via improper delegation denial verification
Summary: CVE-2026-123591 hickory-net: hickory-proto: Hickory DNS: DNSSEC validation by...
Keywords:
Status: NEW
Alias: CVE-2026-123591
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-08 02:06 UTC by OSIDB Bzimport
Modified: 2026-11-08 03:16 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-08 02:06:16 UTC 
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 fail to verify, per RFC 6840 §4.4, that an NSEC or NSEC3 record denying a DS RRset also proves the delegation's NS record exists. Attackers can reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records.
Note You need to log in before you can comment on or make changes to this bug.