CVE-2026-123594: fallo de gravedad media en hickory-dns
Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.3epss 0.1%
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually proves the name exists as an empty non-terminal. On-path attackers can flip the unsigned rcode of a genuine signed NODATA response from NOERROR to NXDOMAIN, causing validators to accept forged nonexistence of the name.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
hickory-dns · hickory-dnsCVEs relacionadas — hickory-dns
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-123608HIGHHickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name CompressionEPSS 0.4%CVE-2026-123606HIGHHickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral AmplificationEPSS 0.4%CVE-2026-123577HIGHHickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of ServiceEPSS 0.4%CVE-2026-123576HIGHHickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC RequestsEPSS 0.4%CVE-2026-123575HIGHHickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request BodiesEPSS 0.4%CVE-2026-123571HIGHHickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA DecodingEPSS 0.4%