NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
HIGH severity

CVE-2026-123595 — Hickory-Dns

HIGH

CVE-2026-123595 is a high-severity (CVSS 8.8) CWE-345 vulnerability in hickory-dns hickory-dns. A fix is available — see the affected versions and patch details below.

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which…

Published
Updated
Affected
2 products
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Description

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.

Affected Products

2 products · 2 configurations
Application
hickory-dnshickory-dns
≤ 0.26.0-alpha.1
1 version
0.25
Application
hickory-dnshickory-dns
< 0.26.2
1 version
0.26.0-beta.1

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every hickory-dns hickory-dns deployment and check each version against the affected-products list above.

  2. Fix

    Apply the hickory-dns hickory-dns security patch or hotfix for CVE-2026-123595 on the affected version, following the vendor advisory for your exact build.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.
O3 Security · Runtime Protection

Is CVE-2026-123595 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
CVE-2026-123595: Hickory-Dns (High 8.8)