Bug 2568763 (CVE-2026-123587) - CVE-2026-123587 hickory-net: hickory-net: DNSSEC validation bypass via unverified SOA records
Summary: CVE-2026-123587 hickory-net: hickory-net: DNSSEC validation bypass via unveri...
Keywords:
Status: NEW
Alias: CVE-2026-123587
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-08 02:02 UTC by OSIDB Bzimport
Modified: 2026-11-08 02:27 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-08 02:02:08 UTC 
The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can combine a genuine NSEC record and its RRSIG with a crafted SOA record to forge nonexistence of any RRset.
Note You need to log in before you can comment on or make changes to this bug.