{"id":"CVE-2026-123580","aliases":["DEBIAN-CVE-2026-123580","EUVD-2026-119339","GHSA-p2jv-r3m3-7wf4","GHSA-wgx4-v7mx-crxr","RUSTSEC-2026-0505","RUSTSEC-2026-0509","UBUNTU-CVE-2026-123580"],"status":"published","title":"Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00255,"percentile":0.17268,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:38Z","fixes":[{"ecosystem":"Debian:14","package":"rust-hickory-net","fixed_in":["0.26.3-1"],"sources":["osv"]},{"ecosystem":"crates.io","package":"hickory-proto","fixed_in":["0.26.0-beta.1"],"sources":["osv"]},{"ecosystem":"crates.io","package":"hickory-net","fixed_in":["0.26.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.3-1"}]}],"versions":["0.26.1-1","0.26.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-4.1","0.24.4-5","0.24.4-6","0.25.2-1","0.25.2-2","0.25.2-3","0.26.1-1","0.26.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-4.1","0.24.4-5","0.24.4-6","0.25.2-1","0.25.2-2","0.25.2-3","0.26.1-1","0.26.3-1"]},{"source":"osv","ecosystem":"crates.io","package":"hickory-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.0-beta.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hickory-net","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-6","0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-4.1","0.24.4-6"]}],"products":[{"vendor":"hickory-dns","product":"hickory-dns"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-p2jv-r3m3-7wf4","tags":["vendor-advisory","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/hickory-dns-0.26.0-beta.1-before-0.26.2-dnssec-nonexistence-proof-forgery-via-nsec3","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123580","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wgx4-v7mx-crxr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123580.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123580","tags":["advisory"]},{"url":"https://crates.io/crates/hickory-proto","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0505.html","tags":["advisory"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/10840b8432feb08d369f82e2bb6ce99ae23d7afa","tags":["web"]},{"url":"https://crates.io/crates/hickory-net","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0509.html","tags":["advisory"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/d2ee774a789193010f109d3d463adf72c4c261ab","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-123580","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123580","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123580","title":"Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.","status":"published","published":"2026-11-08T01:38:14.779Z","modified":"2026-11-12T13:08:17.209Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-08T02:36:49.037074Z"}],"euvd":[{"id":"EUVD-2026-119339","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.","status":"published","published":"2026-11-08T01:38:14Z","modified":"2026-11-12T13:08:17Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T06:12:04.782489Z"}],"ghsa":[{"id":"GHSA-wgx4-v7mx-crxr","title":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1...","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.","status":"published","published":"2026-11-08T03:30:35Z","modified":"2026-11-08T03:30:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-08T03:41:54.072675Z"}],"nvd":[{"id":"CVE-2026-123580","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.","status":"published","published":"2026-11-08T02:16:51.54Z","modified":"2026-11-12T13:17:14.837Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-12T15:31:32.275584Z"}],"osv":[{"id":"CVE-2026-123580","title":"Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.","status":"published","published":"2026-11-08T01:38:14.779Z","modified":"2026-11-12T14:10:38.251619656Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-12T14:22:44.226553Z"},{"id":"DEBIAN-CVE-2026-123580","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.","status":"published","published":"2026-11-08T02:16:51.54Z","modified":"2026-11-11T09:47:38.613657247Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-08T16:07:04.53493Z"},{"id":"RUSTSEC-2026-0505","title":"NSEC3 owner names not checked against the zone in DNSSEC validation (hickory-proto)","description":"Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation matched NSEC3 records to a name only by the hashed first label of the NSEC3 owner name, without checking that the rest of the owner name was the zone in question. A signed NSEC3 record from any zone the attacker controls could therefore be used, by someone who can answer or modify DNS responses, to prove that a name in another zone does not exist.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.","status":"published","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:38.251619656Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-12T14:22:44.226553Z"},{"id":"RUSTSEC-2026-0509","title":"NSEC3 records from another zone were accepted in proofs of nonexistence","description":"When DNSSEC validation used NSEC3 records to prove that a name or record type does not exist, it compared only the hashed first label of each NSEC3 owner name with the hash of the name being checked. The rest of the owner name, which says which zone the record belongs to, was not checked.\n\nSomeone who controls any DNSSEC-signed zone can publish a signed NSEC3 record whose first label is the hash of a name in another zone. An attacker who can answer or modify DNS responses can then use it to make the validator accept that the name in the other zone does not exist.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix requires a matching NSEC3 record to belong to a zone that contains the checked name, and ignores NSEC3 records whose owner is not directly below the RRSIG signer name. It is in 0.26.2.","status":"published","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:10:38.251619656Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-12T14:22:44.226553Z"},{"id":"UBUNTU-CVE-2026-123580","description":"Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records from another zone with a matching hash label to forge DNSSEC nonexistence proofs.","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T02:50:21.780818316Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-10T03:18:58.105788Z"}]}}