CVE-2026-123591: high-severity vulnerability in hickory-dns
Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checks
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.1%
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 fail to verify, per RFC 6840 §4.4, that an NSEC or NSEC3 record denying a DS RRset also proves the delegation's NS record exists. Attackers can reuse child-side NSEC or NSEC3 records to fake an insecure delegation and forge child-zone records.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
hickory-dns · hickory-dnsRelated CVEs — hickory-dns
In the same product, most dangerous first.
CVE-2026-123608HIGHHickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name CompressionEPSS 0.4%CVE-2026-123606HIGHHickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral AmplificationEPSS 0.4%CVE-2026-123577HIGHHickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of ServiceEPSS 0.4%CVE-2026-123576HIGHHickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC RequestsEPSS 0.4%CVE-2026-123575HIGHHickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request BodiesEPSS 0.4%CVE-2026-123571HIGHHickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA DecodingEPSS 0.4%