{"id":"CVE-2026-123581","aliases":["AZL-113218","DEBIAN-CVE-2026-123581","EUVD-2026-119340","GHSA-6w9h-68h2-v6xq","GHSA-929p-gjf6-5hqj","RUSTSEC-2026-0512","RUSTSEC-2026-0520","UBUNTU-CVE-2026-123581"],"status":"published","title":"Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00126,"percentile":0.02319,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:54Z","fixes":[{"ecosystem":"Debian:14","package":"rust-hickory-net","fixed_in":["0.26.3-1"],"sources":["osv"]},{"ecosystem":"crates.io","package":"hickory-proto","fixed_in":["0.26.0-beta.1"],"sources":["osv"]},{"ecosystem":"crates.io","package":"hickory-net","fixed_in":["0.26.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.10.3-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.3-1"}]}],"versions":["0.26.1-1","0.26.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-4.1","0.24.4-5","0.24.4-6","0.25.2-1","0.25.2-2","0.25.2-3","0.26.1-1","0.26.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-2","0.24.4-3","0.24.4-4","0.24.4-4.1","0.24.4-5","0.24.4-6","0.25.2-1","0.25.2-2","0.25.2-3","0.26.1-1","0.26.3-1"]},{"source":"osv","ecosystem":"crates.io","package":"hickory-proto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.0-beta.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"hickory-net","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.26.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-net","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-6","0.26.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hickory-proto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24.4-4.1","0.24.4-6"]}],"products":[{"vendor":"hickory-dns","product":"hickory-dns"}],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj","tags":["vendor-advisory","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-unrelated-rrset","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123581","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6w9h-68h2-v6xq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123581.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-123581","tags":["advisory"]},{"url":"https://crates.io/crates/hickory-proto","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0512.html","tags":["advisory"]},{"url":"https://github.com/hickory-dns/hickory-dns/commit/77ec9c5d2e9481a0753bbaf1be3cd5175d300cff","tags":["web"]},{"url":"https://crates.io/crates/hickory-net","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0520.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-123581","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123581","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-123581","title":"Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","status":"published","published":"2026-11-08T01:38:15.448Z","modified":"2026-11-10T17:57:50.919Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-345"],"updated_at":"2026-11-08T02:36:49.037074Z"}],"euvd":[{"id":"EUVD-2026-119340","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","status":"published","published":"2026-11-08T01:38:15Z","modified":"2026-11-10T17:57:50Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-08T06:12:04.782489Z"}],"ghsa":[{"id":"GHSA-6w9h-68h2-v6xq","title":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2...","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","status":"published","published":"2026-11-08T03:30:35Z","modified":"2026-11-08T03:30:39Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-08T03:41:53.166172Z"}],"nvd":[{"id":"CVE-2026-123581","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","status":"published","published":"2026-11-08T02:16:51.693Z","modified":"2026-11-10T22:15:59.797Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-345"],"updated_at":"2026-11-10T20:21:09.207118Z"}],"osv":[{"id":"CVE-2026-123581","title":"Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","status":"published","published":"2026-11-08T01:38:15.448Z","modified":"2026-11-12T14:40:54.645975781Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-12T14:53:10.251383Z"},{"id":"DEBIAN-CVE-2026-123581","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","status":"published","published":"2026-11-08T02:16:51.693Z","modified":"2026-11-11T10:00:52.666579564Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-11T10:35:16.464644Z"},{"id":"RUSTSEC-2026-0512","title":"DNSSEC validation accepted an unrelated signed RRset as the answer (hickory-proto)","description":"Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation treated a response with a non-empty answer section as a positive answer if its records validated, without checking that any of them matched the queried name and type. Someone who can answer or modify DNS responses could return a genuine signed RRset for another name or type and have it accepted as a validated answer.\n\nFrom 0.26.0-beta.1 the DNSSEC validation code lives in the hickory-net crate, where this was fixed in hickory-net 0.26.2. No hickory-proto release contains a fix. Users of DNSSEC validation in older hickory-proto releases (directly or through hickory-resolver or hickory-recursor) should move to the 0.26.2 or later releases, which validate through hickory-net.","status":"published","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:54.645975781Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-12T14:53:10.251383Z"},{"id":"RUSTSEC-2026-0520","title":"DNSSEC validation accepted a validly signed but unrelated RRset as the answer","description":"When a response had a non-empty answer section, DNSSEC validation treated it as a positive answer as long as the records in it validated. It did not check that any of those records had the queried name and either the queried type or type CNAME.\n\nAn attacker who can answer or modify DNS responses can therefore return a genuine, signed RRset for some other name or type, and have it accepted as a validated answer to the query instead of being handled as a response with no matching data.\n\nThis affects DNSSEC validation through `DnssecDnsHandle` when built with `dnssec-ring` or `dnssec-aws-lc-rs`.\n\nThe fix requires at least one answer record that matches the query name and is either of the queried type or a CNAME, both for positive responses and when NSEC records are checked. It is in 0.26.2.","status":"published","published":"2026-09-03T12:00:00Z","modified":"2026-11-12T14:40:54.645975781Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-12T14:53:10.251383Z"},{"id":"UBUNTU-CVE-2026-123581","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T02:49:53.300995653Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-10T03:18:58.105788Z"},{"id":"AZL-113218","title":"CVE-2026-123581 affecting package netavark 1.10.3-9","description":"Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.","status":"published","published":"2026-11-08T02:16:51Z","modified":"2026-11-11T14:17:32.323086355Z","updated_at":"2026-11-11T14:42:54.020399Z"}]}}