CVE-2026-123580 Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123580?
CVE-2026-123580 is a high-severity vulnerability in hickory-dns, published on 8 Nov 2026.
Official description
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.
Weakness: CWE-290
Which versions are affected by CVE-2026-123580?
2 open source packages ship an affected version, including hickory-net and hickory-proto.
| Package | Affected | Fixed in |
|---|---|---|
hickory-net crates.io | From 0.0.0-0 | 0.26.2 |
hickory-proto crates.io | From 0.0.0-0 | 0.26.0-beta.1 |
How do I fix CVE-2026-123580?
Upgrade hickory-net to 0.26.2 or later.
Is CVE-2026-123580 being exploited?
There is no known exploitation of CVE-2026-123580 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-123580, GHSA-p2jv-r3m3-7wf4, GHSA-wgx4-v7mx-crxr, RUSTSEC-2026-0505, RUSTSEC-2026-0509, UBUNTU-CVE-2026-123580.