CVE-2026-123579 Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansion
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123579?
CVE-2026-123579 is a medium-severity vulnerability in hickory-dns, published on 8 Nov 2026.
Official description
DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.
Weakness: CWE-358
Which versions are affected by CVE-2026-123579?
How do I fix CVE-2026-123579?
Upgrade to a fixed version.
Is CVE-2026-123579 being exploited?
There is no known exploitation of CVE-2026-123579 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-123579, GHSA-vrv5-968r-5ggm, GHSA-xcqq-jfxv-w8jq, UBUNTU-CVE-2026-123579.