CVE-2026-123581 Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123581?
CVE-2026-123581 is a medium-severity vulnerability in hickory-dns, published on 8 Nov 2026.
Official description
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.
Weakness: CWE-345
Which versions are affected by CVE-2026-123581?
2 open source packages ship an affected version, including hickory-net and hickory-proto.
| Package | Affected | Fixed in |
|---|---|---|
hickory-net crates.io | From 0.0.0-0 | 0.26.2 |
hickory-proto crates.io | From 0.0.0-0 | 0.26.0-beta.1 |
How do I fix CVE-2026-123581?
Upgrade hickory-net to 0.26.2 or later.
Is CVE-2026-123581 being exploited?
There is no known exploitation of CVE-2026-123581 in the wild and no public exploit code.
Sources
Also known as AZL-113218, DEBIAN-CVE-2026-123581, GHSA-6w9h-68h2-v6xq, GHSA-929p-gjf6-5hqj, RUSTSEC-2026-0512, RUSTSEC-2026-0520 and 1 more.